SAP Business Client vulnerabilities

4 CVEs affecting SAP Business Client, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-38150, published 2021-09-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-2398, published 2018-03-14. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Under certain conditions SAP Business Client 6.5 allows an attacker to access information which would otherwise be restricted.
CVE-2021-38150, published 2021-09-14. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP Business Client versions - 7.0, 7.70, will allow him to…
CVE-2020-6228, published 2020-04-14. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. SAP Business Client, versions 6.5, 7.0, does not perform necessary integrity checks which could be exploited by an attacker under certain conditions to modify the installer.
CVE-2020-6244, published 2020-05-12. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file in untrusted directories that can be executed by the…