Description
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal content, or user redirection. This results in a low impact on confidentiality and integrity. There is no impact on availability.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
SAP_SE SAP NetWeaver Enterprise Portal
Default version status: unaffected
EP-ADMIN 7.50affected