Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2024-39600— [CVE-2024-39600] Information Disclosure vulnerability in SAP GUI for Windows

CVSS 5.0 · Medium EPSS 0.06% · P18
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2024-39600

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
[CVE-2024-39600] Information Disclosure vulnerability in SAP GUI for Windows
Source: NVD (National Vulnerability Database)
Vulnerability Description
Under certain conditions, the memory of SAP GUI for Windows contains the password used to log on to an SAP system, which might allow an attacker to get hold of the password and impersonate the affected user. As a result, it has a high impact on the confidentiality but there is no impact on the integrity and availability.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
SAP GUI 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP GUI是德国思爱普（SAP）公司的一个应用软件。SAP系统的图形用户界面。 SAP GUI for Windows 存在信息泄露漏洞，该漏洞源于在某些条件下，内存包含用于登录SAP系统的密码，可能允许攻击者获取密码并冒充受影响的用户，对机密性有高影响，但对完整性和可用性无影响。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
SAP_SESAP GUI for Windows BC-FES-GUI 8 -

II. Public POCs for CVE-2024-39600

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-39600

请登录查看更多情报信息。

Same Patch Batch · SAP_SE · 2024-07-09 · 18 CVEs total

CVE-2024-395927.7 HIGH[CVE-2024-39592] Missing Authorization check in SAP PDCE
CVE-2024-395977.2 HIGH[CVE-2024-39597] Improper Authorization Checks on Early Login Composable Storefront B2B si
CVE-2024-395936.9 MEDIUM[CVE-2024-39593] Information Disclosure vulnerability in SAP Landscape Management
CVE-2024-395946.1 MEDIUM[CVE-2024-39594] Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Wareh
CVE-2024-346856.1 MEDIUM[CVE-2024-34685] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Knowledge Manag
CVE-2024-371736.1 MEDIUM[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
CVE-2024-371746.1 MEDIUM[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
CVE-2024-395955.4 MEDIUM[CVE-2024-39594] Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Wareh
CVE-2024-371725.4 MEDIUM[CVE-2024-37172] Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Mana
CVE-2024-395985.0 MEDIUM[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
CVE-2024-346895.0 MEDIUM[CVE-2024-34689] Server-Side Request Forgery in SAP Business Workflow (WebFlow Services)
CVE-2024-371715.0 MEDIUM[CVE-2024-37171] Server-Side Request Forgery (SSRF) in SAP Transportation Management (Coll
CVE-2024-395994.7 MEDIUM[CVE-2024-39599] Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP
CVE-2024-371754.3 MEDIUM[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
CVE-2024-395964.3 MEDIUM[CVE-2024-39596] Missing Authorization check vulnerability in SAP Enable Now
CVE-2024-371804.1 MEDIUM[CVE-2024-37180] Information Disclosure vulnerability in SAP NetWeaver Application Server
CVE-2024-346923.3 LOW[CVE-2024-34692] Unrestricted File upload vulnerability in SAP Enable Now

IV. Related Vulnerabilities

Same product: SAP GUI for Windows
Same vendor: SAP_SE
Same weakness: CWE-200

V. Comments for CVE-2024-39600

No comments yet

Leave a comment