CVE-2021-21448
low-risk
Published 2021-01-12
SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend systems in the client PCs memory. Under certain conditions the attacker can access information which would otherwise be restricted. The exploit can only be executed locally on the client PC and not via Network and the attacker needs at least user authorization of the Operating System user of the victim.
Do I need to act?
-
0.05% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.5/10
Medium
LOCAL
/ LOW complexity
Affected Products (1)
Graphical User Interface
Affected Vendors
References (4)
Permissions Required
https://launchpad.support.sap.com/#/notes/2992269
Permissions Required
https://launchpad.support.sap.com/#/notes/2992269
26
/ 100
low-risk
Severity
21/34 · High
Exploitability
0/34 · Minimal
Exposure
5/34 · Minimal