CVE-2021-38150

6.5 MEDIUM

When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, S...

Published: 2021-09-14 · Last updated: 2026-06-17

Severity and scoring

CVSS: 6.5 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CWE: CWE-312

Affected products

Vendor	Product
sap	business_client

Description

When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP Business Client versions - 7.0, 7.70, will allow him to read extremely sensitive data, such as credentials. This would allow the attacker to compromise the corresponding backend for which the credentials are valid.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-38150
[Other]https://launchpad.support.sap.com/#/notes/3060621
[Vendor advisory]https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405
[Other]https://launchpad.support.sap.com/#/notes/3060621
[Vendor advisory]https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405

Related CVEs

Same vendor

CVE-2026-27680 — Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascad... (3.1 LOW)
CVE-2026-40135 — An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authentica... (6.5 MEDIUM)
CVE-2026-27682 — Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Serv... (4.7 MEDIUM)
CVE-2026-34257 — Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL tha... (6.1 MEDIUM)
CVE-2026-27674 — Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could suppl... (6.1 MEDIUM)

Same CWE

CVE-2026-46622 — SolidInvoice is an open-source invoicing platform (8.1 HIGH)
CVE-2026-10786 — Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain... (6.5 MEDIUM)
CVE-2026-36176 — GNCC GP5 v7.1.76 was discovered to store pre-signed Backblaze B2 upload URLs (PUT requests) in plaintext to the serial console (7.1 HIGH)
CVE-2026-4387 — StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a...
CVE-2026-45040 — RustFS is a distributed object storage system built in Rust