CVE-2023-37484
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
SAP PowerDesigner version 16.7 queries all password hashes in the backend database and compares them with the user-provided one during login attempts. This may allow an attacker to access password hashes from the client's memory.
Risk Assessment
An attacker could gain access to password hashes, posing a risk of unauthorized access to user accounts. This could lead to serious security breaches within the organization.
Recommendation
It is recommended to update SAP PowerDesigner to the latest version to minimize the risk associated with this vulnerability. Additionally, implementing extra data protection measures, such as password encryption, is advisable.
Original NVD description (English source)
SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which might allow an attacker to access password hashes from the client's memory.