SAP NetWeaver Cross-Site Scripting Vulnerability

A Cross-Site Scripting vulnerability has been identified in SAP NetWeaver (ABAP Keyword Documentation). This issue allows an unauthenticated attacker to inject malicious JavaScript into a web page via an unprotected parameter. When a victim visits the affected page, the injected script executes in their browser, potentially giving the attacker limited access to restricted information. The vulnerability is confined to the client's browser context and does not impact data integrity or availability.

Impact

Exploitation of this vulnerability allows for Cross-Site Scripting, where injected scripts are executed in the context of the user's browser.

Remediation

Users are advised to review and implement the SAP Security Note related to this vulnerability. This can be done through the SAP for Me platform, specifically in the Security Notes section. SAP NetWeaver security fixes are also included in regular Support Package updates.