VDB
CVE-2021-38150
CVE-2021-38150
PUBLISHED
CVSS 6.1 MEDIUM
Reported by sap · Published September 14, 2021
When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP Business Client versions - 7.0, 7.70, will allow him to read extremely sensitive data, such as credentials. This would allow the attacker to compromise the corresponding backend for which the credentials are valid.
Risk scores
CVSS 3.0
6.1
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP Business Client | < 7.0, < 7.70 |
| SAP SE | SAP Business Client | 0, 0 |
Timeline
- Sep 14, 2021 CVE Published
- Sep 15, 2021 EPSS Score (30 in total, the first dated here)
- Aug 4, 2024 CVE Updated
- Apr 4, 2026 Security Advisory
- Jul 25, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2021-38150
vulnetix vdb fixes CVE-2021-38150Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-38150/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart