An unauthenticated attacker can craft a URL that injects malicious JavaScript into a parameter processed by SAP NetWeaver Enterprise Portal. The script is reflected back in the server response and executed in the victim’s browser when the URL is visited, allowing the attacker to steal session data, alter portal content, or redirect the user. The impact is limited to confidentiality and integrity of the application, with no effect on availability, as described by the vendor.

All installations of SAP NetWeaver Enterprise Portal are affected. No specific version range is supplied in the advisory, so all releases of the product should be considered potentially vulnerable until a patch is issued.

The CVSS score of 6.1 indicates moderate risk, and the EPSS score of less than 1% suggests very low probability of real‑world exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated attacker sending the crafted URL to a legitimate user; the user must open or click the link in a web browser for the script to run. No additional attacker privileges or network conditions are required beyond access to the public web interface.