CVE-2025-42979 — Insecure Storage of Sensitive Information in SE SAP GUI FOR Windows

CWE-922 — Insecure Storage of Sensitive Information3 documents3 sources
Severity
5.6MEDIUMNVD
EPSS
0.0%
top 93.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
SAP SE SAP GUI FOR Windows
Timeline
PublishedJul 8

Description

The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credentials of an RFC user on the client PC. This leads to a high impact on confidentiality because any attacker who gains access to the user hive of this user�s windows registry could recreate the original password. There is no impact on integrity or availability of the application

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:NExploitability: 1.1 | Impact: 4.0

Affected Packages1 packages

▶CVEListV5sap_se/sap_gui_for_windowsBC-FES-GUI 8.00

🔴Vulnerability Details

2
CVEList
Insecure Key & Secret Management vulnerability in SAP GUI for Windows↗2025-07-08
▶
GHSA
GHSA-3px8-gf2c-qqrh: The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the c↗2025-07-08
▶
CVE-2025-42979 — SE SAP GUI FOR Windows vulnerability | cvebase