Medium severity · published Jul 9, 2024
CVE-2024-39600
[CVE-2024-39600] Information Disclosure vulnerability in SAP GUI for Windows
4.2
CVSS
0.1%
EPSS
No
On KEV
Description
Under certain conditions, the memory of SAP GUI
for Windows contains the password used to log on to an SAP system, which might
allow an attacker to get hold of the password and impersonate the affected
user. As a result, it has a high impact on the confidentiality but there is no
impact on the integrity and availability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SG
SAP GUI for Windows · SAP_SE
BC-FES-GUI 8 · source: vendor
GF
Gui For Windows · Sap
8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39600
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39600
Permissions Required
https://me.sap.com/notes/3461110
Vendor Advisory
https://url.sap/sapsecuritypatchday
More from SAP GUI for Windows
6.0
CVE-2025-24870
Insecure Key & Secret Management vulnerability in SAP GUI for Windows
6.0
CVE-2025-0055
Information Disclosure vulnerability in SAP GUI for Windows
5.6
CVE-2025-42979
Insecure Key & Secret Management vulnerability in SAP GUI for Windows
5.5
CVE-2025-42888
Information Disclosure vulnerability in SAP GUI for Windows
4.5
CVE-2025-42943
Information Disclosure in SAP GUI for Windows