CVE-2023-40310

SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external entities in BPMN2 file, although not used, would be accessed during import. A successful attack could impact availability of SAP PowerDesigner Client.

Weakness

The product accepts XML from an untrusted source but does not validate the XML against the proper schema.

Affected Software

Potential Mitigations

• Always validate XML input against a known XML Schema or DTD.
• It is not possible for an XML parser to validate all aspects of a document’s content because a parser cannot understand the complete semantics of the data. However, a parser can do a complete and thorough job of checking the document’s structure and therefore guarantee to the code that processes the document that the content is well-formed.

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/230.html
• https://cwe.mitre.org/data/definitions/231.html

References

• https://me.sap.com/notes/3357154
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html