Description

Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is processed and reflected within the DOM on the client side during page rendering, resulting in the execution of malicious content in the victim's browser context. Successful exploitation could result in a high impact to the confidentiality and a low impact to the integrity of the system, while availability remains unaffected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-11T01:17:24.403Z",
  "pubdate": "2026-08-11T01:17:24.403Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability has been identified within SAP NetWeaver Application Server ABAP, posing significant security risks to enterprise environments. This vulnerability arises from improper handling of user-supplied input, allowing an authenticated attacker to craft and distribute a malicious URL that leads to arbitrary client-side script execution.\nSuccessful exploitation of this flaw requires the attacker to generate a malicious link and make it publicly accessible, subsequently requiring an authenticated victim to interact with and access the resource. Upon rendering the page, the injected input is processed and reflected within the Document Object Model (DOM) directly in the victim's browser context.\nThe resulting security impact primarily affects data confidentiality, allowing potential exposure of sensitive session data or user information, while integrity impacts remain low and availability is unaffected. Due to the requirement of user interaction via an authenticated session, organizations must implement strict input validation and output encoding mechanisms to neutralize this attack vector.",
  "technicalDetails": "The vulnerability is a DOM-based Cross-Site Scripting (XSS) flaw localized within SAP NetWeaver Application Server ABAP. The root cause stems from the application's failure to adequately sanitize or encode user-controllable input before dynamically rendering it into the Document Object Model (DOM) during client-side page processing.\nThe attack flow proceeds as follows: First, an authenticated attacker leverages the input reflection vector to construct a malicious URL containing arbitrary JavaScript or HTML payloads. Second, the attacker distributes this crafted link, making it publicly accessible to potential targets. Third, an authenticated victim navigates to the malicious link within their browser. Fourth, the vulnerable component processes the request and reflects the unsanitized input directly into the client-side DOM during the rendering phase. Finally, the victim's browser executes the injected script within the context of the vulnerable application session.\nPrerequisites for this attack include authentication for both the attacker (to generate the malicious link context) and the victim (to trigger the execution upon accessing the link). The vulnerability manifests over the network through standard web protocols used by SAP NetWeaver Application Server ABAP.\nThe execution of the malicious payload occurs entirely within the victim's browser context, granting the script access to session tokens, cookies, and DOM elements accessible to the application origin. Consequently, successful exploitation results in a high impact to confidentiality through unauthorized data access, and a low impact to system integrity, with system availability remaining entirely unaffected."
}