A specific component of SAP Business Server Pages, TAF_APPLAUNCHER, can accept specially crafted URLs from unauthenticated users. When a victim clicks such a link, the application redirects the browser to an attacker‑controlled site. This behavior can lead to the disclosure or alteration of sensitive data within the victim’s browser session, though it does not affect the availability of the application itself. The flaw is a classic input‑validation weakness represented by CWE‑601.

The vulnerability is present in versions of SAP Business Server Pages identified by the following CPEs: SAP Business Server Pages 2008_1_700, 2008_1_710, 740, and 758. These versions correspond to the Business Server Pages Application (TAF_APPLAUNCHER) from SAP SE.

The CVSS score of 6.1 indicates a medium severity level. The EPSS score is below 1 %, suggesting a low probability of exploitation at this moment. The vulnerability is not listed in CISA’s known exploited vulnerabilities catalog. The attack vector is relatively straightforward: an attacker does not need authentication or privileged access; they only need to trick a user into clicking a malicious link, which can be delivered via email or embedded in web content. If exploited, the impact is limited to confidentiality and integrity within the victim’s browser context and does not impair application availability.