CVE-2021-27612 : In specific situations SAP GUI for Windows until and including 7.60 PL9, 7.70 PL

In specific situations SAP GUI for Windows until and including 7.60 PL9, 7.70 PL0, forwards a user to specific malicious website which could contain malware or might lead to phishing attacks to steal credentials of the victim.

Published 2021-05-11 15:15:08

Updated 2021-06-29 13:50:26

Source SAP SE

View at NVD, CVE.org

Vulnerability category: Open redirect

Products affected by CVE-2021-27612

SAP » Gui For Windows » Version: 7.60
cpe:2.3:a:sap:gui_for_windows:7.60:-:*:*:*:*:*:*
Matching versions
SAP » Gui For Windows » Version: 7.60 Update Patch Level1
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level1:*:*:*:*:*:*
Matching versions
SAP » Gui For Windows » Version: 7.60 Update Patch Level2
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level2:*:*:*:*:*:*
Matching versions
SAP » Gui For Windows » Version: 7.60 Update Patch Level3
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level3:*:*:*:*:*:*
Matching versions
SAP » Gui For Windows » Version: 7.60 Update Patch Level4
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level4:*:*:*:*:*:*
Matching versions
SAP » Gui For Windows » Version: 7.60 Update Patch Level5
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level5:*:*:*:*:*:*
Matching versions
SAP » Gui For Windows » Version: 7.60 Update Patch Level6
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level6:*:*:*:*:*:*
Matching versions
SAP » Gui For Windows » Version: 7.60 Update Patch Level7
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level7:*:*:*:*:*:*
Matching versions
SAP » Gui For Windows » Version: 7.60 Update Patch Level8
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level8:*:*:*:*:*:*
Matching versions
SAP » Gui For Windows » Version: 7.60 Update Patch Level8 Hotfix1
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level8_hotfix1:*:*:*:*:*:*
Matching versions
SAP » Gui For Windows » Version: 7.60 Update Patch Level9
cpe:2.3:a:sap:gui_for_windows:7.60:patch_level9:*:*:*:*:*:*
Matching versions
SAP » Gui For Windows » Version: 7.70
cpe:2.3:a:sap:gui_for_windows:7.70:-:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-27612

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 35 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-27612

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:N	8.6	4.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
3.4	LOW	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N	1.6	1.4	SAP SE
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: None Availability: None
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2021-27612

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-27612

https://launchpad.support.sap.com/#/notes/3023078

SAP ONE Support Launchpad: Log On
Permissions Required;Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=576094655

SAP Security Patch Day – May 2021 - Product Security Response at SAP - Community Wiki
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2021-27612

Products affected by CVE-2021-27612

Exploit prediction scoring system (EPSS) score for CVE-2021-27612

CVSS scores for CVE-2021-27612

CWE ids for CVE-2021-27612

References for CVE-2021-27612