Read the docs
TI-2021-17550 Aliases CVE-2021-40503GHSA-j8r9-mcxg-mjg4

Insufficiently protected credentials in SAP GUI for Windows

Priority LOW 33CWE-522Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-522.

Summary

An information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13, 7.70 PL4, which allows an attacker with sufficient privileges on the local client-side PC to obtain an equivalent of the user’s password. With this highly sensitive data leaked, the attacker would be able to logon to the backend system the SAP GUI for Windows was connected to and launch further attacks depending on the authorizations of the user.

Why it matters now

EPSS 0.00225 13th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP GUI for Windows< 7.60 PL13; < 7.70 PL4—No fix listedCNA
  • SAP GUI for Windows VendorSAP Affected < 7.60 PL13; < 7.70 PL4 Fixed in — No fix listed CNA

CPE configurations NVD · 19

CPEVersionsRoleVendor
cpe:2.3:a:sap:gui_for_windows:*:*:*:*:*:*:*:*before 7.60VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:-:*:*:*:*:*:*7.60VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level1:*:*:*:*:*:*7.60 patch_level1VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level10:*:*:*:*:*:*7.60 patch_level10VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level11:*:*:*:*:*:*7.60 patch_level11VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level12:*:*:*:*:*:*7.60 patch_level12VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level2:*:*:*:*:*:*7.60 patch_level2VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level3:*:*:*:*:*:*7.60 patch_level3VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level4:*:*:*:*:*:*7.60 patch_level4VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level5:*:*:*:*:*:*7.60 patch_level5VulnerableSAP
  • cpe:2.3:a:sap:gui_for_windows:*:*:*:*:*:*:*:* Versions before 7.60 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:-:*:*:*:*:*:* Versions 7.60 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level1:*:*:*:*:*:* Versions 7.60 patch_level1 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level10:*:*:*:*:*:* Versions 7.60 patch_level10 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level11:*:*:*:*:*:* Versions 7.60 patch_level11 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level12:*:*:*:*:*:* Versions 7.60 patch_level12 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level2:*:*:*:*:*:* Versions 7.60 patch_level2 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level3:*:*:*:*:*:* Versions 7.60 patch_level3 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level4:*:*:*:*:*:* Versions 7.60 patch_level4 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level5:*:*:*:*:*:* Versions 7.60 patch_level5 Vulnerable ·SAP
Show 9 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level6:*:*:*:*:*:*7.60 patch_level6VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level7:*:*:*:*:*:*7.60 patch_level7VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level8:*:*:*:*:*:*7.60 patch_level8VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level8_hotfix1:*:*:*:*:*:*7.60 patch_level8_hotfix1VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level9:*:*:*:*:*:*7.60 patch_level9VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.70:-:*:*:*:*:*:*7.70VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.70:patch_level1:*:*:*:*:*:*7.70 patch_level1VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.70:patch_level2:*:*:*:*:*:*7.70 patch_level2VulnerableSAP
cpe:2.3:a:sap:gui_for_windows:7.70:patch_level3:*:*:*:*:*:*7.70 patch_level3VulnerableSAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level6:*:*:*:*:*:* Versions 7.60 patch_level6 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level7:*:*:*:*:*:* Versions 7.60 patch_level7 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level8:*:*:*:*:*:* Versions 7.60 patch_level8 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level8_hotfix1:*:*:*:*:*:* Versions 7.60 patch_level8_hotfix1 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.60:patch_level9:*:*:*:*:*:* Versions 7.60 patch_level9 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.70:-:*:*:*:*:*:* Versions 7.70 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.70:patch_level1:*:*:*:*:*:* Versions 7.70 patch_level1 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.70:patch_level2:*:*:*:*:*:* Versions 7.70 patch_level2 Vulnerable ·SAP
  • cpe:2.3:a:sap:gui_for_windows:7.70:patch_level3:*:*:*:*:*:* Versions 7.70 patch_level3 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-40503
  2. 2026-10-03 Alias added: GHSA-j8r9-mcxg-mjg4

References

Advisory 2

  • TI-2017-04660 SAP GUI 7.2 through 7.5 allows remote attackers to bypass intended security policy… CVSS 3.0CRITICAL 9.8
  • TI-2023-15416 Information Disclosure vulnerability in SAP GUI for Windows CVSS 3.1CRITICAL 9.3
  • TI-2021-09064 Open redirect in SAP GUI for Windows CVSS 3.1MEDIUM 6.1
  • TI-2024-26530 [CVE-2024-39600] Information Disclosure vulnerability in SAP GUI for Windows CVSS 3.1MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences