CVE-2023-40310 Missing XML Validation vulnerability in SAP PowerDesigner Client BPMN2 import

Medium 6.5 Published 10 Oct 2023 Updated 18 Sep 2024

An attacker can cause denial of service in SAP PowerDesigner Client by importing a malicious BPMN2 XML file that triggers external entity access.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-40310?

CVE-2023-40310 is a medium-severity vulnerability in SAP_SE SAP PowerDesigner Client, published on 10 Oct 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external entities in BPMN2 file, although not used, would be accessed during import. A successful attack could impact availability of SAP PowerDesigner Client.

Weakness: CWE-112

Which versions are affected by CVE-2023-40310?

It affects 1 product.

Products include Sap Powerdesigner.

How do I fix CVE-2023-40310?

No fix has been published for CVE-2023-40310 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-40310 being exploited?

There is no known exploitation of CVE-2023-40310 in the wild and no public exploit code.

Sources

Also known as GHSA-4wqh-m4m9-qjm8.