The vulnerability is a browser-based cross‑site scripting flaw that allows an unauthenticated attacker to craft a malicious URL. When a victim follows that link, the attacker's code is executed inside the victim’s browser, enabling the attacker to access or modify sensitive application data, thereby compromising confidentiality and integrity while leaving availability intact.

SAP Supplier Relationship Management, specifically the SICF Handler in the SRM Catalog. No vendor‑specific version information is provided in the CVE data, so all installations that include this handler are potentially impacted until a patch is applied.

The CVSS score of 6.1 indicates moderate risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation appears to require an attacker to supply a malicious link to a user, suggesting a social‑engineering or remote‑access attack vector that can be mitigated with timely patching and user awareness.