Improperly implemented security check for standard in PowerDesigner - CVE-2023-40621

Vulnerability identifier: #VU80713

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2023-40621

CWE-ID: CWE-358

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: SAP

Affected software:
PowerDesigner

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to SAP PowerDesigner Client by default is installed with turned off security option to disable or prompt users before executing external scripts. A remote attacker can trick the victim to open a specially crafted file with a malicious VBScript code inside and execute it on the system.

Install updates from vendor's website.

• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html?september2023