CVE-2023-40621

CWE-94 — Code Injection3 documents3 sources

Severity

6.3MEDIUM

EPSS

0.2%

top 53.13%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

SAP SE SAP Powerdesigner Client SAP Powerdesigner

Timeline

PublishedSep 12

Latest updateSep 13

Description

SAP PowerDesigner Client - version 16.7, allows an unauthenticated attacker to inject VBScript code in a document and have it opened by an unsuspecting user, to have it executed by the application on behalf of the user. The application has a security option to disable or prompt users before untrusted scripts are executed, but this is not set as default.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:LExploitability: 2.8 | Impact: 3.4

Affected Packages2 packages

▶CVEListV5sap_se/sap_powerdesigner_client16.7

▶NVDsap/powerdesigner16.7

🔴Vulnerability Details

GHSA

GHSA-h8m5-rv6r-f3vq: SAP PowerDesigner Client - version 16↗2023-09-13

▶

CVEList

Code Injection vulnerability in SAP PowerDesigner Client↗2023-09-12

▶