PT-2021-14516 · Sap · Sap Gui For Windows

Published 2021-01-12 · Updated 2022-07-12 · CVE-2021-21448

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP GUI for Windows version 7.60

Description The issue allows an attacker to spoof logon credentials for Application Server ABAP backend systems in the client PC's memory. Under certain conditions, the attacker can access information that would otherwise be restricted. The exploit can only be executed locally on the client PC and not via the network, and the attacker needs at least user authorization of the Operating System user of the victim.

Recommendations For SAP GUI for Windows version 7.60, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2021-21448

Affected Products

Sap Gui For Windows

References · 6

• https://osv.dev/vulnerability/CVE-2021-21448 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21448 · Security Note
• https://t.me/cibsecurity/21959 · Telegram Post
• https://launchpad.support.sap.com/#/notes/2992269 · Note
• https://t.me/cvenotify/10465 · Telegram Post