Unauthenticated attackers can create a malicious URL that injects a script into an unprotected query string. When a user follows that link, the script is rendered by the web application and runs in the victim’s browser context, allowing the attacker to read or alter data owned by the user. This results in a compromise of confidentiality and integrity of application data, while availability remains unaffected.

This vulnerability affects SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages) from SAP. Specific affected release numbers are not listed; the issue applies to all installations that use the unprotected URL parameter handling within Business Server Pages.

The CVSS score is 4.7, indicating moderate severity. With no EPSS score available and no listing in the CISA KEV catalog, current exploitation risk appears limited but the vulnerability does rely on user interaction; thus it is primarily a social‑engineering vector. If exploited, the attacker could gain the victim’s privileges in the application. The lack of a publicly documented exploit does not preclude future use of generic XSS payloads.