Sap Netweaver Enterprise Portal
Monthly
Open redirect in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context, enabling user-information tracking and page defacement. The vulnerability requires user interaction (UI:R) and results in low confidentiality and integrity impact with no availability impact, yielding a CVSS score of 6.1. No public exploit code has been identified at time of analysis.
Unauthenticated information disclosure in SAP NetWeaver Enterprise Portal allows remote attackers to bypass resource restrictions and retrieve non-critical application information, producing only a low confidentiality impact (CVSS 5.3). The issue is mapped to CWE-552 and tagged as path traversal, so exposed portals may leak reconnaissance-grade data rather than credentials or code execution. No public exploit identified at time of analysis; exposure is reduced when the portal is not internet-facing or is protected by a reverse proxy/WAF that filters traversal patterns.
Reflected cross-site scripting in SAP NetWeaver Enterprise Portal allows unauthenticated remote attackers to inject a malicious script into a URL parameter that is reflected back in the server response, where it executes in the browser of any portal user who opens the crafted link. Exploitation depends on user interaction (CVSS 3.1 base 6.1, MEDIUM, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and can result in theft of session information, manipulation of portal content, or redirection of the victim. No public exploit identified at time of analysis.
Reflected cross-site scripting in SAP NetWeaver Enterprise Portal enables unauthenticated remote attackers to inject arbitrary JavaScript into URL parameters that are echoed back unencoded in server responses. When a victim with an active portal session visits a crafted URL, the injected script executes in their browser under the portal's origin, permitting session token theft, unauthorized manipulation of portal content, or forced redirection to attacker-controlled resources. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, though the unauthenticated network-accessible attack surface and low complexity make phishing-based delivery operationally straightforward.
Open redirect in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context, enabling user-information tracking and page defacement. The vulnerability requires user interaction (UI:R) and results in low confidentiality and integrity impact with no availability impact, yielding a CVSS score of 6.1. No public exploit code has been identified at time of analysis.
Unauthenticated information disclosure in SAP NetWeaver Enterprise Portal allows remote attackers to bypass resource restrictions and retrieve non-critical application information, producing only a low confidentiality impact (CVSS 5.3). The issue is mapped to CWE-552 and tagged as path traversal, so exposed portals may leak reconnaissance-grade data rather than credentials or code execution. No public exploit identified at time of analysis; exposure is reduced when the portal is not internet-facing or is protected by a reverse proxy/WAF that filters traversal patterns.
Reflected cross-site scripting in SAP NetWeaver Enterprise Portal allows unauthenticated remote attackers to inject a malicious script into a URL parameter that is reflected back in the server response, where it executes in the browser of any portal user who opens the crafted link. Exploitation depends on user interaction (CVSS 3.1 base 6.1, MEDIUM, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and can result in theft of session information, manipulation of portal content, or redirection of the victim. No public exploit identified at time of analysis.
Reflected cross-site scripting in SAP NetWeaver Enterprise Portal enables unauthenticated remote attackers to inject arbitrary JavaScript into URL parameters that are echoed back unencoded in server responses. When a victim with an active portal session visits a crafted URL, the injected script executes in their browser under the portal's origin, permitting session token theft, unauthorized manipulation of portal content, or forced redirection to attacker-controlled resources. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, though the unauthenticated network-accessible attack surface and low complexity make phishing-based delivery operationally straightforward.