CVE-2023-37484

Published Aug 8, 2023

Last updated 2 months ago

CVSS medium 5.3

Overview

Description: SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which might allow an attacker to access password hashes from the client's memory.
Source: cna@sap.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.3
Impact score: 1.4
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity: MEDIUM

Weaknesses

cna@sap.com: CWE-327

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:sap:powerdesigner:16.7:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E17F2B57-5B4A-4718-8123-CBF87F1CCFE0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References