SAP UI5 does not perform sufficient input validation when configured in certain ways, allowing an attacker with low privileges to submit specially crafted content that is rendered in a victim’s browser. This cross‑site scripting flaw can lead to malicious scripts executing in the victim’s context, presenting a low‑impact risk to confidentiality and integrity while availability is unaffected.

The vulnerability affects SAP UI5, as distributed by SAP SE. No specific version ranges are listed in the CNA data, so all current and legacy SAP UI5 installations that have not applied the patch referenced in SAP note 3799054 are potentially vulnerable.

The CVSS score of 4.4 reflects a low severity flaw. EPSS data is not available and the issue is not listed in CISA’s KEV catalog, indicating limited public exploitation. The likely attack vector is through user input that passes through SAP UI5 rendering when configuration does not enforce proper sanitization. Since the attacker requires low privileges, the risk to systems that properly restrict user input is reduced, but a production environment that exposes open input fields remains susceptible.