EUVD-2026-43590
GHSA-xvvp-5jh4-5684
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-accessible reflected XSS; AC:H for specific BSP parameter condition; UI:R for mandatory victim interaction; S:C for browser context pivot; no server availability impact.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server ABAP reflects unsanitized input into the HTTP response which allows an attacker to inject and execute arbitrary JavaScript code under certain conditions. Successful exploitation could allow the attacker to steal session information, perform authenticated actions on behalf of the victim user etc. This vulnerability has low impact on confidentiality and integrity of the data and no impact on application 's availability.
AnalysisAI
Reflected XSS in SAP NetWeaver Application Server ABAP's Business Server Pages (BSP) framework allows remote unauthenticated attackers to inject arbitrary JavaScript into HTTP responses when a victim user interacts with a crafted URL. Successful exploitation enables session token theft and execution of authenticated actions on behalf of the victim within the SAP web context. No public exploit code or CISA KEV listing is identified at time of analysis; CVSS AC:H indicates non-trivial conditions must align for successful delivery, moderating real-world risk despite the enterprise sensitivity of SAP environments.
Technical ContextAI
The vulnerability resides in SAP NetWeaver AS ABAP's Business Server Pages (BSP) framework - SAP's proprietary ABAP-based server-side scripting environment used to render web UI within the SAP Web Application Server (ICM). CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-supplied HTTP request parameters are reflected back into the HTTP response without adequate output encoding or sanitization, causing the victim's browser to interpret attacker-controlled content as executable JavaScript rather than inert text. The Scope:Changed metric in the CVSS vector correctly captures the pivot - the server-side SAP application is the vulnerable component, but the injected code executes within the victim's browser security context. The CPE string cpe:2.3:a:sap_se:sap_netweaver_application_server_abap_(applications_based_on_business_server_pages):*:*:*:*:*:*:*:* uses a wildcard version range, indicating SAP has not restricted the vulnerability to a discrete version band in the NVD entry; the authoritative version scope must be obtained from SAP Security Note 3754659.
RemediationAI
Apply the fix documented in SAP Security Note 3754659 (https://me.sap.com/notes/3754659) as the primary remediation; the exact patched version must be confirmed directly from the note, as no specific release version is extractable from the available intelligence data (patch available per vendor advisory). As a compensating control pending patch deployment, restrict BSP application access to internal networks using SAP Web Dispatcher ACLs or perimeter firewall rules, reducing the attack surface for the network-accessible (AV:N) vector - note this does not protect against insider or VPN-connected attacker delivery. Additionally, configure Content Security Policy (CSP) response headers at the SAP ICM level if the deployment supports it; CSP can block inline script execution and significantly limits XSS payload utility even if injection occurs, though it may require testing against existing BSP applications that legitimately use inline scripts. Monitor SAP access logs and Web Dispatcher logs for anomalous query parameters containing script tags or encoded JavaScript. Consult https://url.sap/sapsecuritypatchday for the full SAP Security Patch Day release for any related notes.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today