CVE-2023-33985
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
SAP NetWeaver Enterprise Portal version 7.50 does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability. Successful exploitation allows an attacker to view or modify information, causing limited impact on confidentiality and integrity of the application.
Risk Assessment
The organization may be exposed to attacks that could lead to data disclosure or modification, impacting the application's security. Although the impact is limited, the risk of data breaches remains significant.
Recommendation
It is recommended to update SAP NetWeaver Enterprise Portal to the latest version to patch this vulnerability and implement additional security measures against XSS.
Other vulnerabilities in SAP NetWeaver Enterprise Portal 7.50
See all- CVE-2026-89122Medium
SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context, potentially allowing tracking of user information and defacement of parts of the page.
- CVE-2026-89118Medium
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information. This leads to low impact on confidentiality, with no impact on integrity and availability.
- CVE-2026-89117Medium
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, potentially leading to session information theft, portal content manipulation, or user redirection.
- CVE-2026-44759Medium
A vulnerability in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited.
- CVE-2025-42872Medium
XSS vulnerability in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts that execute in the context of other users' browsers, enabling theft of session cookies, tokens, and other sensitive information. The impact on confidentiality and integrity is low, and no impact on availability.
- CVE-2025-42884Medium
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider. This could further lead to disclosure or modification of information about the server. There is no impact on availability.
Original NVD description (English source)
SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS