fkie_cve-2021-40503
Vulnerability from fkie_nvd
Published
2021-11-10 16:15
Modified
2024-11-21 06:24
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
An information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13, 7.70 PL4, which allows an attacker with sufficient privileges on the local client-side PC to obtain an equivalent of the user’s password. With this highly sensitive data leaked, the attacker would be able to logon to the backend system the SAP GUI for Windows was connected to and launch further attacks depending on the authorizations of the user.
References
cna@sap.comhttps://launchpad.support.sap.com/#/notes/3080106Permissions Required, Vendor Advisory
cna@sap.comhttps://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://launchpad.support.sap.com/#/notes/3080106Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864Vendor Advisory
Impacted products
Vendor Product Version
sap gui_for_windows *
sap gui_for_windows 7.60
sap gui_for_windows 7.60
sap gui_for_windows 7.60
sap gui_for_windows 7.60
sap gui_for_windows 7.60
sap gui_for_windows 7.60
sap gui_for_windows 7.60
sap gui_for_windows 7.60
sap gui_for_windows 7.60
sap gui_for_windows 7.60
sap gui_for_windows 7.60
sap gui_for_windows 7.60
sap gui_for_windows 7.60
sap gui_for_windows 7.60
sap gui_for_windows 7.70
sap gui_for_windows 7.70
sap gui_for_windows 7.70
sap gui_for_windows 7.70


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:gui_for_windows:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "603CB0D2-BEA4-4414-AE50-39F9A8E568F2",
              "versionEndExcluding": "7.60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:gui_for_windows:7.60:-:*:*:*:*:*:*",
              "matchCriteriaId": "FA071418-F2F0-4530-94C0-94D9295FED83",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:gui_for_windows:7.60:patch_level1:*:*:*:*:*:*",
              "matchCriteriaId": "E27CD53C-8CA1-4204-829D-3343AC4565B4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:gui_for_windows:7.60:patch_level10:*:*:*:*:*:*",
              "matchCriteriaId": "0D89F8F8-929B-4D17-B921-CAB3CA2FD405",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:gui_for_windows:7.60:patch_level11:*:*:*:*:*:*",
              "matchCriteriaId": "41F78A30-CD1A-4F6D-85DF-26FAF4BCF3AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:gui_for_windows:7.60:patch_level12:*:*:*:*:*:*",
              "matchCriteriaId": "F9E07A43-B98A-4E56-B32D-CC6768AAA937",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:gui_for_windows:7.60:patch_level2:*:*:*:*:*:*",
              "matchCriteriaId": "1E0246DF-E354-4191-91DA-99880E1BD08A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:gui_for_windows:7.60:patch_level3:*:*:*:*:*:*",
              "matchCriteriaId": "140210E1-95C6-4EB5-A854-44E9EA03DD27",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:gui_for_windows:7.60:patch_level4:*:*:*:*:*:*",
              "matchCriteriaId": "0FD672D2-D67A-4576-8F9B-92177AF51151",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:gui_for_windows:7.60:patch_level5:*:*:*:*:*:*",
              "matchCriteriaId": "AE686D3C-E814-42D6-9F33-839763B53968",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:gui_for_windows:7.60:patch_level6:*:*:*:*:*:*",
              "matchCriteriaId": "711DE87F-72AA-4A6F-8F53-18758A195ED3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:gui_for_windows:7.60:patch_level7:*:*:*:*:*:*",
              "matchCriteriaId": "8E44C0EE-8ED0-42E8-81FB-7FE7FC9308E7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:gui_for_windows:7.60:patch_level8:*:*:*:*:*:*",
              "matchCriteriaId": "98A928B5-F8AA-4CD0-A8A5-D4E04AB3856A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:gui_for_windows:7.60:patch_level8_hotfix1:*:*:*:*:*:*",
              "matchCriteriaId": "9415406D-32AF-41EB-A351-2DE0306657DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:gui_for_windows:7.60:patch_level9:*:*:*:*:*:*",
              "matchCriteriaId": "C7B83282-AD56-455F-9979-4F4D145F9798",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:gui_for_windows:7.70:-:*:*:*:*:*:*",
              "matchCriteriaId": "FE1286F1-B9A5-4F25-B083-272943D90023",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:gui_for_windows:7.70:patch_level1:*:*:*:*:*:*",
              "matchCriteriaId": "FF605CA1-E860-4185-A358-FE967E0DE408",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:gui_for_windows:7.70:patch_level2:*:*:*:*:*:*",
              "matchCriteriaId": "181183AC-5621-4895-82E1-E91D9DCAB69A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:gui_for_windows:7.70:patch_level3:*:*:*:*:*:*",
              "matchCriteriaId": "DD057E0A-C836-46ED-ACB3-1C80CECACD60",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An information disclosure vulnerability exists in SAP GUI for Windows - versions \u003c 7.60 PL13, 7.70 PL4, which allows an attacker with sufficient privileges on the local client-side PC to obtain an equivalent of the user\u2019s password. With this highly sensitive data leaked, the attacker would be able to logon to the backend system the SAP GUI for Windows was connected to and launch further attacks depending on the authorizations of the user."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en SAP GUI para Windows - versiones anteriores a 7.60 PL13, 7.70 PL4, que permite a un atacante con privilegios suficientes en el PC local del lado del cliente obtener un equivalente de la contrase\u00f1a del usuario. Con estos datos altamente confidenciales filtrados, el atacante podr\u00eda iniciar la sesi\u00f3n en el sistema backend al que estaba conectada la SAP GUI para Windows y lanzar otros ataques en funci\u00f3n de las autorizaciones del usuario"
    }
  ],
  "id": "CVE-2021-40503",
  "lastModified": "2024-11-21T06:24:16.697",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.1,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-11-10T16:15:08.757",
  "references": [
    {
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/3080106"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/3080106"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ],
      "source": "cna@sap.com",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.