CVE-2023-37483

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SAP PowerDesigner - version 16.7, has improper access control which might allow an unauthenticated attacker to run arbitrary queries against the back-end database via Proxy.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Aug 8, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-374845.3SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during logiCVE-2023-374867.5Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access iCVE-2023-374875.3SAP Business One (Service Layer) - version 10.0, allows an authenticated attacker with deep knowledge perform certain operation to access unCVE-2023-374886.1In SAP NetWeaver Process Integration - versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, user-controlled inputs, if not sufficiently CVE-2023-374895.3Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unauCVE-2023-37495.5A local user could edit the VideoEdge configuration file and interfere with VideoEdge operation.CVE-2023-374909.0SAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the network to overwrite an executable file creaCVE-2023-374918.8The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.2CVE-2023-374926.5SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740CVE-2023-374955.9Internet passwords stored in Person documents in the Domino® Directory created using the "Add Person" action on the People & Groups tab in tCVE-2023-374965.4HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability. An attacker could execute script in a victim's web browser tCVE-2023-374978.8The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certai
CVE-2023-37483: Critical severity, CVSS 9.8 | Vulnix