CVE-2023-37484: Information Disclosure Vulnerabilities in SAP PowerDesigner
SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which might allow an attacker to access password hashes from the client's memory.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-37484?
CVE-2023-37484 is a vulnerability in SAP PowerDesigner version 16.7 that allows an attacker to access password hashes from the client's memory.
How does SAP PowerDesigner version 16.7 handle passwords?
SAP PowerDesigner version 16.7 queries all password hashes in the backend database and compares them with the user-provided one during a login attempt.
What is the severity of CVE-2023-37484?
The severity of CVE-2023-37484 is medium with a CVSS score of 5.3.
How can an attacker exploit CVE-2023-37484?
An attacker can exploit CVE-2023-37484 by accessing password hashes from the client's memory.
Is there a fix for CVE-2023-37484?
To fix CVE-2023-37484, it is recommended to update SAP PowerDesigner to a version that does not have this vulnerability.