SAP NetWeaver Application Server for ABAP contains an ABAP report that can send HTTP requests to arbitrary internal or external endpoints. The report unintentionally exposes a Server‑Side Request Forgery vulnerability, which could allow an attacker to query sensitive internal services. The impact is limited to potential disclosure of confidential data through internal traffic; there is no effect on data integrity or application availability.

SAP NetWeaver Application Server for ABAP is the affected product. No specific versions are listed in the CNA data, so all releases of this product are considered potentially vulnerable until a patch is applied.

The CVSS score is 6.4, indicating a moderate severity, and the EPSS score is less than 1 %, suggesting a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an authenticated or publicly exposed ABAP report endpoint that accepts arbitrary URLs. Successful exploitation would allow remote interaction with internal endpoints but would not compromise the availability of the application.