CVE-2021-40503
Quick assessment
Affected
SAP SE SAP GUI for Windows
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP GUI是德国思爱普（SAP）公司的一个应用软件。SAP系统的图形用户界面。 SAP GUI for Windows 存在信息泄露漏洞，该漏洞源于应用程序输出过多的数据。远程用户可以获得对系统敏感信息的未经授权访问权。
Possible ATT&CK Techniques 1 AI
T1003.001 · LSASS Memory
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-40503
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13, 7.70 PL4, which allows an attacker with sufficient privileges on the local client-side PC to obtain an equivalent of the user’s password. With this highly sensitive data leaked, the attacker would be able to logon to the backend system the SAP GUI for Windows was connected to and launch further attacks depending on the authorizations of the user.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5
Vulnerability Title
SAP GUI 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP GUI是德国思爱普（SAP）公司的一个应用软件。SAP系统的图形用户界面。 SAP GUI for Windows 存在信息泄露漏洞，该漏洞源于应用程序输出过多的数据。远程用户可以获得对系统敏感信息的未经授权访问权。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP SE | SAP GUI for Windows | < 7.60 PL13 | - |
|
II. Public POCs for CVE-2021-40503
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-40503
请登录查看更多情报信息。
Other References for CVE-2021-40503 (1)
-
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=589496864 x_refsource_MISC
Same Patch Batch · SAP SE · 2021-11-10 · 5 CVEs total
| CVE-2021-42062 | SAP ERP HCM 安全漏洞 | |
| CVE-2021-40504 | SAP NetWeaver Application Server 权限许可和访问控制问题漏洞 | |
| CVE-2021-40502 | SAP Commerce 授权问题漏洞 | |
| CVE-2021-40501 | SAP AS ABAP 授权问题漏洞 |
IV. Related Vulnerabilities
Same product: SAP GUI for Windows
-
CVE-2025-42888
Information Disclosure vulnerability in SAP GUI for Windows -
CVE-2025-42943
Information Disclosure in SAP GUI for Windows -
CVE-2025-42979
Insecure Key & Secret Management vulnerability in SAP GUI fo -
CVE-2025-43005
Information Disclosure vulnerability in SAP GUI for Windows -
CVE-2025-24870
Insecure Key & Secret Management vulnerability in SAP GUI fo
Same vendor: SAP SE
-
CVE-2025-42956
Multiple vulnerabilities in SAP NetWeaver Application Server -
CVE-2023-36920
Clickjacking vulnerability in SAP Enable Now -
CVE-2023-40307
Privileges Memory Corruption (Out-of-bound write) -
CVE-2023-40306
URL Redirection vulnerability in SAP S/4HANA (Manage Catalog -
CVE-2022-41211
SAP 3D Visual Enterprise Viewer和SAP 3D Visual Enterprise Aut
Same weakness: CWE-522
-
CVE-2026-92537
Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protect -
CVE-2026-100264
JetBrains YouTrack 2026.2前SMTP凭据泄露漏洞 -
CVE-2026-100298
Insufficiently Protected Credentials in Anjvision YSSD-RTMP- -
CVE-2026-81930
Apache Airflow Snowflake provider: Unvalidated account field -
CVE-2026-101089
Nezha before 2.2.7 Information Disclosure via /api/v1/profil
V. Comments for CVE-2021-40503
No comments yet