Medium severity · published May 13, 2025
CVE-2025-43005
Information Disclosure vulnerability in SAP GUI for Windows
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
SAP GUI for Windows allows an unauthenticated attacker to exploit insecure obfuscation algorithms used by the GuiXT application to store user credentials. While this issue does not impact the Integrity or Availability of the application, it may have a Low impact on the Confidentiality of data.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SG
SAP GUI for Windows · SAP_SE
BC-FES-GUI 8.00 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-43005
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-43005
me.sap.com
https://me.sap.com/notes/3574520
url.sap
https://url.sap/sapsecuritypatchday
More from SAP GUI for Windows
6.0
CVE-2025-24870
Insecure Key & Secret Management vulnerability in SAP GUI for Windows
6.0
CVE-2025-0055
Information Disclosure vulnerability in SAP GUI for Windows
5.6
CVE-2025-42979
Insecure Key & Secret Management vulnerability in SAP GUI for Windows
5.5
CVE-2025-42888
Information Disclosure vulnerability in SAP GUI for Windows
4.5
CVE-2025-42943
Information Disclosure in SAP GUI for Windows