EUVD-2026-43589
GHSA-fhgw-7ffq-9wp7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-reachable unauthenticated endpoint (AV:N/PR:N); scope change to browser context (S:C); low C/I reflect session theft and content manipulation; UI:R required for reflected delivery.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal content, or user redirection, resulting in a low impact on the application's confidentiality and integrity, with no impact on availability.
AnalysisAI
Reflected cross-site scripting in SAP NetWeaver Enterprise Portal enables unauthenticated remote attackers to inject arbitrary JavaScript into URL parameters that are echoed back unencoded in server responses. When a victim with an active portal session visits a crafted URL, the injected script executes in their browser under the portal's origin, permitting session token theft, unauthorized manipulation of portal content, or forced redirection to attacker-controlled resources. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, though the unauthenticated network-accessible attack surface and low complexity make phishing-based delivery operationally straightforward.
Technical ContextAI
SAP NetWeaver Enterprise Portal is a Java-based enterprise integration and user interface platform that aggregates SAP and non-SAP business applications into a unified web experience, widely deployed in large enterprise SAP landscapes. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the reflected subtype: user-controlled input supplied via a URL parameter is incorporated into the HTTP response body without adequate output encoding or sanitization, allowing HTML and JavaScript injection into the rendered page. The affected CPE (cpe:2.3:a:sap_se:sap_netweaver_enterprise_portal:*:*:*:*:*:*:*:*) uses a full wildcard on version, indicating SAP has not constrained the vulnerable range to a specific release, suggesting broad version exposure. The Scope:Changed (S:C) metric in the CVSS vector correctly characterizes the trust-boundary crossing inherent to XSS: the exploit originates in the web application but executes in the security context of the victim's browser.
RemediationAI
The primary remediation is to apply SAP's patch as documented in SAP Note 3746678 (https://me.sap.com/notes/3746678); the exact patched version or support package stack level must be confirmed via that note, as specific version details are not independently available from the current data set - consult the SAP Security Patch Day page (https://url.sap/sapsecuritypatchday) for release-specific guidance. As compensating controls prior to patching, deploying a Web Application Firewall with reflected XSS detection rules for SAP portal URL parameters can interrupt delivery of crafted payloads, though WAF bypass techniques exist and this should not substitute for patching. Enforcing a strict Content-Security-Policy (CSP) header on portal responses to restrict inline script execution can significantly reduce the impact of any successful injection; note that SAP portal environments often rely on inline JavaScript and thorough testing is required before enabling CSP in production. Restricting portal access to VPN or corporate network segments eliminates unauthenticated external reachability and is the strongest compensating control available where business requirements permit it.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today