{"id":"CVE-2024-39600","aliases":["EUVD-2024-38120","GHSA-g274-v7wr-8cmq"],"status":"published","title":"[CVE-2024-39600] Information Disclosure vulnerability in SAP GUI for Windows","description":"Under certain conditions, the memory of SAP GUI\nfor Windows contains the password used to log on to an SAP system, which might\nallow an attacker to get hold of the password and impersonate the affected\nuser. As a result, it has a high impact on the confidentiality but there is no\nimpact on the integrity and availability.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00148,"percentile":0.04103,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2024-07-09T04:19:47Z","modified":"2026-06-17T07:42:18Z","products":[{"vendor":"sap","product":"gui_for_windows"},{"vendor":"sap_se","product":"sap gui for windows"}],"references":[{"url":"https://url.sap/sapsecuritypatchday","tags":["x_transferred","Vendor Advisory"]},{"url":"https://me.sap.com/notes/3461110","tags":["x_transferred","Permissions Required"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39600"},{"url":"https://github.com/advisories/GHSA-g274-v7wr-8cmq"}],"sources":{"cve":[{"id":"CVE-2024-39600","title":"[CVE-2024-39600] Information Disclosure vulnerability in SAP GUI for Windows","description":"Under certain conditions, the memory of SAP GUI\nfor Windows contains the password used to log on to an SAP system, which might\nallow an attacker to get hold of the password and impersonate the affected\nuser. As a result, it has a high impact on the confidentiality but there is no\nimpact on the integrity and availability.","status":"published","published":"2024-07-09T04:19:47.498Z","modified":"2024-08-02T04:26:16.037Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:19.28149Z"}],"euvd":[{"id":"EUVD-2024-38120","description":"Under certain conditions, the memory of SAP GUI\nfor Windows contains the password used to log on to an SAP system, which might\nallow an attacker to get hold of the password and impersonate the affected\nuser. As a result, it has a high impact on the confidentiality but there is no\nimpact on the integrity and availability.","status":"published","published":"2024-07-09T04:19:47Z","modified":"2024-08-02T04:26:16Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:17.469599Z"}],"ghsa":[{"id":"GHSA-g274-v7wr-8cmq","title":"Under certain conditions, the memory of SAP GUI\nfor Windows contains the password used to log on...","description":"Under certain conditions, the memory of SAP GUI\nfor Windows contains the password used to log on to an SAP system, which might\nallow an attacker to get hold of the password and impersonate the affected\nuser. As a result, it has a high impact on the confidentiality but there is no\nimpact on the integrity and availability.","status":"published","published":"2024-07-09T06:30:40Z","modified":"2024-07-09T06:30:41Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:57:39.292896Z"}],"nvd":[{"id":"CVE-2024-39600","description":"Under certain conditions, the memory of SAP GUI\nfor Windows contains the password used to log on to an SAP system, which might\nallow an attacker to get hold of the password and impersonate the affected\nuser. As a result, it has a high impact on the confidentiality but there is no\nimpact on the integrity and availability.","status":"published","published":"2024-07-09T05:15:13.147Z","modified":"2026-06-17T07:42:18.483Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:10:10.545705Z"}]}}