CVE-2023-37484

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which might allow an attacker to access password hashes from the client's memory.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-327

Affected software

No affected versions have been published.

Timeline

Published
Aug 8, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-374867.5Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access iCVE-2023-374875.3SAP Business One (Service Layer) - version 10.0, allows an authenticated attacker with deep knowledge perform certain operation to access unCVE-2023-374886.1In SAP NetWeaver Process Integration - versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, user-controlled inputs, if not sufficiently CVE-2023-374895.3Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unauCVE-2023-37495.5A local user could edit the VideoEdge configuration file and interfere with VideoEdge operation.CVE-2023-374909.0SAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the network to overwrite an executable file creaCVE-2023-374918.8The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.2CVE-2023-374926.5SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740CVE-2023-374955.9Internet passwords stored in Person documents in the Domino® Directory created using the "Add Person" action on the People & Groups tab in tCVE-2023-374965.4HCL Verse is susceptible to a Stored Cross Site Scripting (XSS) vulnerability. An attacker could execute script in a victim's web browser tCVE-2023-374978.8The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certaiCVE-2023-374988.8A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator.  It is possible that an
CVE-2023-37484: Medium severity, CVSS 5.3 | Vulnix