CVE-2021-40503 Information

Description

An information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13 7.70 PL4 which allows an attacker with sufficient privileges on the local client-side PC to obtain an equivalent of the user’s password. With this highly sensitive data leaked the attacker would be able to logon to the backend system the SAP GUI for Windows was connected to and launch further attacks depending on the authorizations of the user.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Reference

https://launchpad.support.sap.com/#/notes/3080106 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

7.8