This vulnerability (CWE-451) in SAPUI5 (Search UI) involves user interface misrepresentation where an attacker can manipulate specific URL parameters without authentication to include malicious content. This manipulation can cause the application to render attacker-controlled pages, potentially misleading users. The vulnerability affects multiple SAPUI5 versions including 1.71, 1.84, 1.96, 1.108, 1.120, 1.136, and 1.142. The CVSS 3.1 base score is 4.7, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, low confidentiality impact, and no integrity or availability impact. No patch or official remediation level has been published by SAP as of the data provided.

The vulnerability allows an unauthenticated attacker to manipulate URL parameters to inject malicious content into the Search UI, potentially misleading users into interacting with attacker-controlled pages. This results in a low confidentiality impact due to possible exposure of information through user deception. There is no impact on the integrity or availability of the application. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been published by SAP, users should monitor SAP advisories for updates. Until a patch is available, consider restricting access to affected SAPUI5 Search UI versions or implementing additional URL validation controls if feasible to reduce risk.