CVE-2023-40621CWE-94

Code Injection vulnerability in SAP PowerDesigner Client

Medium · published September 12, 2023

CVSS v3.1
6.3
EPSS
3%
Percentile
86.8
In the wild
Unconfirmed
What it is

SAP PowerDesigner Client - version 16.7, allows an unauthenticated attacker to inject VBScript code in a document and have it opened by an unsuspecting user, to have it executed by the application on behalf of the user. The application has a security option to disable or prompt users before untrusted scripts are executed, but this is not set as default.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.02894 · 86.8th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2023-09-12T02:10Z
EPSS history
Timeline
  • 12 SEP 02:10Z
    Code Injection vulnerability in SAP PowerDesigner Client
    cvelistv5