The vulnerability is a reflected cross‑site scripting flaw that allows an unauthenticated attacker to inject malicious scripts into a URL parameter. When a user follows the crafted link, the malicious code is echoed back in the response and runs in the victim’s browser, enabling theft of session cookies, alteration of portal content, or forced redirection. The official assessment indicates a low impact on confidentiality and integrity, with no availability effects.

The affected product is SAP NetWeaver Enterprise Portal from SAP SE. Specific versions are not listed in the advisory data; therefore any instance of the Portal that may use the vulnerable code path could be affected.

The CVSS score of 6.1 rates the vulnerability as medium severity. The EPSS score of <1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Because the flaw is triggerable through a URL parameter and does not require authentication, exploitation is straightforward for an unauthenticated attacker who can give a victim the crafted link.