Description
SAP PowerDesigner Client - version 16.7, allows an unauthenticated attacker to inject VBScript code in a document and have it opened by an unsuspecting user, to have it executed by the application on behalf of the user. The application has a security option to disable or prompt users before untrusted scripts are executed, but this is not set as default.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SAP_SE | SAP PowerDesigner Client | 16.7 | — |
Advisories 1
- WID-SEC-2023-2309 SAP Patchday September 2023 BSI CERT-Bund (WID) · Sep 11, 2023