Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

SU01 SAP GUI input history saves passwords, SAP security note 1384632

SAP Note 1384632SAP Security NoteMedium priority

SAP security note 1384632, "SU01: SAP GUI input history saves passwords", is a note released on 09.02.2010. Below are the symptom and SAP recommended solution.

ComponentBasis Components > Security – Read KBA 2985997 for subcomponents > User Administration > Users and Authorization administration
PriorityCorrection with medium priority
TypeSAP Security Note
Version3
StatusReleased for Customer
Released on09.02.2010

Description

Symptom

When using transaction SU01 to generate a new initial password for a user, the password is displayed as plaintext in the password field and saved in the input history of SAP GUI. This poses a security risk.

Solution

  • Use the SAP Note Assistant to implement the correction instructions.
  • Alternatively, import the relevant Support Package.
  • For Basis Release 7.10 or higher, implement Note 1365205.

After applying the solution, the system will display the password only in a dialog box message or, in 7.10 or higher, in a log message. The password will no longer be displayed in the password field.

Reason and prerequisites

This issue is caused by a program error.

References

Full note on SAP: SAP Support Launchpad note 1384632

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#SU01#User Administration#Authorization Administration

Explore More