The vulnerability exists in SAP TAF_APPLAUNCHER within Business Server Pages, allowing an unauthenticated attacker to craft malicious links that, when clicked by a victim, redirect the victim’s browser to attacker‑controlled sites. This can expose or alter sensitive information in the browser, though the impact on confidentiality and integrity is considered low and there is no impact on availability.

The affected product is the SAP Business Server Pages Application (TAF_APPLAUNCHER). No specific version information is provided; all instances of this component are potentially vulnerable until patched.

With a CVSS score of 6.1, the vulnerability is in the medium severity range. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The primary attack vector is remote: an attacker sends a crafted link to a victim and relies on social engineering or passive interception of click actions. Because no authentication is required, the risk remains for any user who may view the affected application. The low impact classification means a successful exploit would mainly redirect or partially manipulate the victim’s browser context rather than fully compromise the system.