Lucene search

SapCVELIST:CVE-2023-36923

HistoryAug 08, 2023 - 12:36 a.m.

CVE-2023-36923 Code Injection vulnerability in SAP PowerDesigner

2023-08-0800:36:59

CWE-94

sap

www.cve.org

cve-2023-36923

sap powerdesigner

sqla

16.7

sp06

pl03

code injection

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

Percentile

5.1%

JSON

SAP SQLA for PowerDesigner 17 bundled with SAP PowerDesigner 16.7 SP06 PL03, allows an attacker with local access to the system, to place a malicious library, that can be executed by the application. An attacker could thereby control the behavior of the application.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP PowerDesigner",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "16.7"
      }
    ]
  }
]

References

me.sap.com/notes/3341599

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVELIST:CVE-2023-36923