SAP NetWeaver Application Server ABAP Open Redirect Vulnerability Allowing Cross-Site Scripting

An open redirect vulnerability has been identified in SAP NetWeaver Application Server ABAP. This vulnerability allows an unauthenticated attacker to create a URL that includes a malicious script, which is not properly sanitized. When a victim clicks on the link, the script executes in their browser, redirecting them to an attacker-controlled site. This exploitation could lead to unauthorized access or modification of restricted information related to the web client. While there is no impact on data availability, the vulnerability significantly risks confidentiality and integrity.

Impact

Exploitation of this vulnerability could result in cross-site scripting, allowing an attacker to execute scripts in the context of the victim's browser.

Remediation

Users are advised to review and implement the SAP Security Note associated with this vulnerability. This can be done through the SAP for Me platform, specifically during the monthly SAP Security Patch Day.