SAP GuiXT Credential Storage Vulnerability in Windows Registry

A vulnerability exists in the GuiXT application, which is integrated with SAP GUI for Windows. The issue arises because the application employs obfuscation algorithms instead of secure symmetric ciphers to store the credentials of an RFC user on the client PC. This flaw allows an attacker with access to the user's Windows registry to reconstruct the original password, significantly compromising confidentiality. However, there is no impact on the integrity or availability of the application.

Impact

Exploitation of this vulnerability allows for the recreation of RFC user passwords from the Windows registry, leading to unauthorized access.

Remediation

Users are advised to review and implement the latest SAP Security Notes. For guidance on accessing and applying these security updates, consult the SAP Security Notes FAQs or the SAP Security Patch Day Bulletin.