The vulnerable Business Service Portal applications allow an unauthenticated user to inject arbitrary script through URL parameters that are not properly sanitized. When a victim follows a crafted link, the script runs in the victim’s browser, potentially exposing confidential information that the victim’s session can access. Although the impact on application availability is negligible, the confidentiality and integrity of the victim’s data can be compromised.

This flaw affects SAP Document Management System versions 600 through 617, the ERP product 618, and the SAP S/4HANA Core systems from 102 to 108, as indicated by the associated versioned CPE entries.

The CVSS score of 6.1 classifies it as moderate risk, and the EPSS score of less than 1% suggests a low probability of exploitation at present. It is not listed in the CISA KEV catalog. The attack requires no privileged credentials; a malicious actor simply constructs a malicious URL and lures a user to it. If successful, the impact is limited to the client side, but the data accessed can be sensitive.