Cross-Site Scripting Issue in SAP NetWeaver Development Infrastructure

CVE-2021-33691

Summary

The NWDI Notification Service in certain versions of SAP NetWeaver Development Infrastructure has a vulnerability due to insufficient encoding of user-controlled inputs. This flaw allows malicious actors to inject crafted scripts that can execute within the context of the victim's session. If a user is active and engaged with the system when the script runs, it can lead to unauthorized access to sensitive session information, potentially compromising the user's data and security.

References