SAP NetWeaver Enterprise Portal contains an input validation flaw in a portal component that fails to properly restrict URLs supplied from external sources. An unauthenticated attacker can create a crafted link that, when clicked, causes the portal to load attacker‑controlled content inside the trusted application context. The attacker could then track user activity, capture details, or deface parts of the rendered page. The impact is limited to low confidentiality and integrity compromise, with no effect on availability.

The affected product is SAP NetWeaver Enterprise Portal, as identified by the SAP Secure Enterprise (SAP_SE) CNA. The precise sub‑versions are not listed in the public entry; however, any installation of NetWeaver Enterprise Portal that has not applied SAP note 3790401 or the corresponding Security Patch Day update is vulnerable. Administrators should verify whether their environment includes the latest security patch for the portal component.

The CVSS base score is 6.1, indicating moderate severity. EPSS information is not available, and the KEV status indicates the CVE is not listed. Exploitation requires no authentication and only an active link click by a victim. Therefore, the attack vector is user‑directed, and the risk remains moderate with low impact on organizational assets. Prompt patching mitigates the threat.