The vulnerability arises from improper handling of user input that is incorporated into a web page. Under specific conditions an attacker can inject custom Cascading Style Sheet code; when a victim opens or clicks the affected page the injected CSS is executed by the browser. This type of injection does not expose data nor change system state, leading to a minimal confidentiality impact while leaving integrity and availability untouched. The weakness is classified as CWE‑276.

SAP NetWeaver Application Server ABAP, as identified by SAP SE. The CVE does not list specific product versions, so all deployed instances of this application server should be checked against SAP Note 3665042 for applicability.

The CVSS score of 3.1 reflects the low severity. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog. The exploitation requires that a user navigate to or interact with the affected page, so user interaction is a prerequisite. Given the low intrinsic severity and the need for manual interaction, the overall risk is considered low to moderate and the likelihood of widespread exploitation is low.