PT-2023-4251 · Sap · Sap Powerdesigner

Published 2023-06-07 · Updated 2024-09-26 · CVE-2023-37484

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP PowerDesigner version 16.7

Description The issue is related to insufficient protection of service data due to the handling of password hashes during login attempts. This may allow a remote attacker to gain unauthorized access to protected information. The vulnerability involves the comparison of user-provided passwords with all password hashes in the backend database during a login attempt, potentially allowing an attacker to access password hashes from the client's memory.

Recommendations For SAP PowerDesigner version 16.7, consider disabling the login functionality that compares user-provided passwords with backend database hashes until a patch is available. Restrict access to the backend database to minimize the risk of exploitation. Avoid using the password variable in the affected login endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-200

CWE-327

Related Identifiers

BDU:2023-04566

CVE-2023-37484

Affected Products

Sap Powerdesigner

References · 9

• https://osv.dev/vulnerability/CVE-2023-37484 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37484 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04566 · Security Note
• https://t.me/cvenotify/96222 · Telegram Post
• https://me.sap.com/notes/3341460 · Note
• https://vuldb.com/?id.236340 · Note
• https://blogs.sap.com/2023/08/08/sap-security-patch-day-august-2023 · Note
• https://t.me/cibsecurity/67945 · Telegram Post