CVE-2021-40503: An information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13, 7.70 PL4, which allows an attacker with sufficient privileges on…

PriorityP339high7.8CVSS 3.1

AVLACLPRLUINSUCHIHAH

EPSS

0.22%

12.2th percentile

An information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13, 7.70 PL4, which allows an attacker with sufficient privileges on the local client-side PC to obtain an equivalent of the user’s password. With this highly sensitive data leaked, the attacker would be able to logon to the backend system the SAP GUI for Windows was connected to and launch further attacks depending on the authorizations of the user.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
sap	gui_for_windows	< 7.60	7.60
sap	gui_for_windows	—	—
sap	gui_for_windows	—	—
sap_se	sap_gui_for_windows	< 7.60 PL13	7.60 PL13
sap_se	sap_gui_for_windows	< 7.70 PL4	7.70 PL4

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.