PT-2021-22910 · Sap · Sap Gui For Windows

Published 2021-11-10 · Updated 2021-11-29 · CVE-2021-40503

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP GUI for Windows versions prior to 7.60 PL13 SAP GUI for Windows versions prior to 7.70 PL4

Description An information disclosure issue exists, allowing an attacker with sufficient privileges on the local client-side PC to obtain an equivalent of the user's password. This leaked data could enable the attacker to logon to the backend system connected to the SAP GUI for Windows and launch further attacks, depending on the user's authorizations.

Recommendations For SAP GUI for Windows versions prior to 7.60 PL13, update to version 7.60 PL13 or later. For SAP GUI for Windows versions prior to 7.70 PL4, update to version 7.70 PL4 or later.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2021-40503

Affected Products

Sap Gui For Windows

References · 5

• https://launchpad.support.sap.com/#/notes/3080106 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40503 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40503 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864 · Vendor Advisory
• https://t.me/cibsecurity/32163 · Telegram Post