The vulnerability is a reflected XSS in the JDBC Test Servlet of SAP NetWeaver AS Java Component UDI. An unauthenticated attacker can embed a malicious script in a crafted URL. When a victim clicks the link, the script is rendered in the browser, allowing the attacker to access or modify data stored in the web client. This compromises confidentiality and integrity of the application with no impact on availability.

SAP NetWeaver AS Java Component UDI, delivered by SAP. The advisory does not specify a particular version, so all installations that include the JDBC Test Servlet are potentially affected.

The CVSS score of 6.1 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires only a crafted URL and no authentication, the risk of exploitation is moderate to high in environments where users may click unknown links. No additional prerequisites are described, so the potential attack surface is limited to the web client itself.