PT-2023-5922 · Sap · Sap Powerdesigner Client

Published 2023-08-14 · Updated 2023-10-11 · CVE-2023-40310

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SAP PowerDesigner Client version 16.7

Description The issue is related to the import function of BPMN files in the Business Process Modeling (BPM) module of the SAP PowerDesigner enterprise architecture modeling tool. It does not sufficiently validate BPMN2 XML documents imported from untrusted sources. As a result, URLs of external entities in the BPMN2 file, although not used, would be accessed during import. A successful attack could impact the availability of the SAP PowerDesigner Client.

Recommendations For SAP PowerDesigner Client version 16.7, consider disabling the import of BPMN2 XML documents from untrusted sources until a patch is available. Restrict access to the BPMN file import function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-112

Related Identifiers

BDU:2023-06618

CVE-2023-40310

Affected Products

Sap Powerdesigner Client

References · 9

• https://bdu.fstec.ru/vul/2023-06618 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-40310 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40310 · Vendor Advisory
• https://vuldb.com/?id.241614 · Note
• https://t.me/cibsecurity/71880 · Telegram Post
• https://help.sap.com/docs/SAP_POWERDESIGNER/d7f65e920f60441db0508baff61c0bd7/c81663fb6e1b1014a045c0a9fe5d6917.html · Note
• https://me.sap.com/notes/3357154 · Note
• https://t.me/cvenotify/59162 · Telegram Post