CVE-2021-40503: sap_se sap gui for windows Insufficiently Protected Credentials
Vulnerability summary
CVE-2021-40503 is a high (CVSS 7.8) Insufficiently Protected Credentials vulnerability in sap_se sap gui for windows. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 12.4% of scored vulnerabilities.
Timeline
- 10-11-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13, 7.70 PL4, which allows an attacker with sufficient privileges on the local client-side PC to obtain an equivalent of the user’s password. With this highly sensitive data leaked, the attacker would be able to logon to the backend system the SAP GUI for Windows was connected to and launch further attacks depending on the authorizations of the user.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
12%
Versus all other CVEs
30-day change
0.00 pp
From 0.22% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Sap1 product
- gui_for_windows< 7.60 | 7.60 | 7.60:patch_level1 | 7.60:patch_level10 | 7.60:patch_level11 | 7.60:patch_level12 | 7.60:patch_level2 | 7.60:patch_level3 | 7.60:patch_level4 | 7.60:patch_level5 | 7.60:patch_level6 | 7.60:patch_level7 | 7.60:patch_level8 | 7.60:patch_level8_hotfix1 | 7.60:patch_level9 | 7.70 | 7.70:patch_level1 | 7.70:patch_level2 | 7.70:patch_level3
Sap_se1 product
- sap gui for windows< 7.60 PL13 | < 7.70 PL4
2 vendors · 2 products