Vulnerability · Published Aug 8, 2023 · Assigned by sap
CVE-2023-37484Information Disclosure Vulnerabilities in SAP PowerDesigner
Medium 5.3
In plain English
A medium-severity broken cryptography in SAP PowerDesigner from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)2.0%top 19.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which might allow an attacker to access password hashes from the client's memory.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP PowerDesigner | 16.7 |
Weakness: CWE-327 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N