Advisory
A note with CVSS 7.5 for component BC-SYB-PD was released by SAP on 09.05.2023. The correction/advisory 3300624 was described with "[CVE-2023-32111] Memory Corruption vulnerability in SAP PowerDesigner (Proxy)" and affects the system type SAP PowerDesigner.
A workaround does not exist, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance.
The vulnerability addressed is denial of service (dos) within SAP PowerDesigner.
Denial of Service (DoS) attacks that take a system offline may lead to significant cost for the company, studies quantify the costs in average between 4 and 5 millions dollars. Business continuity requires SAP systems staying online. The CVSS scores or vulnerability descriptions are not enough to represent how a simple bug can lead to a significant loss for companies.
Risk specification
An attacker can send a crafted request to the proxy machine and crash the proxy server from a remote host.Solution
The Memory handling of SAP PowerDesigner Proxy has been improved
- 9.8 Multiple vulnerabilities associated with Reprise License Manager 14.2 component used with SAP 3D Visual Enterprise License Manager
- 7.8 [CVE-2023-33990] Denial of service (DOS) vulnerability in SAP SQL Anywhere
- 7.7 [CVE-2023-35871] Memory Corruption vulnerability in SAP Web Dispatcher
- 7.5 Denial of service (DOS) in SAP Commerce
- 7.5 [CVE-2020-6186] Denial of Service (DOS) Vulnerability in SAP Host Agent
