The SAP Gateway permits content injection into error messages, which can expose request artefacts such as regex patterns and reveal internal URI parsing logic. The disclosure is limited to privacy concerns; there is no known impact on integrity or availability, resulting in a low confidentiality effect as reflected in the CVSS score of 4.3.

This issue affects SAP"s SAP Gateway, a system extension used for handling web requests and routing within the SAP environment. Specific product version details are not provided, so all deployed instances of SAP Gateway that have not yet applied the SAP Fix are potentially vulnerable.

The CVSS base score of 4.3 indicates a low‑severity risk, and the EPSS score is not available, meaning no known exploitation probability is reported and the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves an attacker crafting requests that trigger rendered error messages, an action that typically requires network access to the SAP Gateway. While the risk is moderate, the absence of a zero‑day impact and the limited scope of information leakage suggest that exposure is unlikely to lead to more severe compromises.