This vulnerability allows an unauthenticated attacker to construct a malicious link that, when clicked by a user of the SAP Business Connector webclient, redirects the browser to a site controlled by the attacker. The cross‑site scripting defect can also enable the attacker to read or modify data stored in the webclient, thereby compromising confidentiality and integrity. No impact on availability is anticipated.

The affected product is SAP Business Connector from SAP, specifically version 4.8 as identified by the CPE. The flaw applies to any deployment that serves the webclient interface to users.

The CVSS base score of 6.1 indicates medium severity. The EPSS score is less than 1 %, suggesting that the likelihood of exploitation in the wild is low. The flaw is not listed in the CISA KEV catalog. Exploitation does not require authentication; the attacker simply needs a victim to click the crafted link. Because the flaw is client‑side, the critical condition for exploitation is user interaction with the malicious URL.