This vulnerability involves improper neutralization of input during web page generation in SAP NetWeaver Application Server ABAP applications using Business Server Pages. The reflected XSS allows an attacker to inject malicious scripts via crafted URLs that are processed unsafely, leading to script execution in the context of the victim's browser. Affected SAP_BASIS versions range from 700 through 918. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity with no availability impact.

Successful exploitation could allow an attacker to execute arbitrary scripts in the victim's browser context, potentially leading to unauthorized access or modification of information within the affected SAP application. This compromises confidentiality and integrity but does not impact system availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted URLs and consider implementing web application firewall (WAF) rules to detect and block suspicious input patterns related to this vulnerability. Monitor SAP security advisories for updates on patches or official mitigations.