{"id":"CVE-2026-44749","aliases":["EUVD-2026-31933","GHSA-53r4-mvj6-w855"],"status":"published","title":"Information Disclosure vulnerability in SAP Gateway","description":"The SAP Gateway allows attackers to inject content into error messages, potentially leading to disclosure of request artefacts (e.g., regex patterns) and revealing underlying URI parsing logic. Leading to low impact on confidentiality. Integrity and availability are unaffected.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00258,"percentile":0.17548,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-497"],"published":"2026-05-26T17:24:33Z","modified":"2026-07-24T11:10:00Z","products":[{"vendor":"sap se","product":"sap gateway"},{"vendor":"sap_se","product":"sap gateway"}],"references":[{"url":"https://me.sap.com/notes/3433366"},{"url":"https://url.sap/sapsecuritypatchday"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44749"},{"url":"https://github.com/advisories/GHSA-53r4-mvj6-w855"}],"sources":{"cve":[{"id":"CVE-2026-44749","title":"Information Disclosure vulnerability in SAP Gateway","description":"The SAP Gateway allows attackers to inject content into error messages, potentially leading to disclosure of request artefacts (e.g., regex patterns) and revealing underlying URI parsing logic. Leading to low impact on confidentiality. Integrity and availability are unaffected.","status":"published","published":"2026-05-26T17:24:33.329Z","modified":"2026-05-26T18:36:16.647Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T13:43:00.288193Z"}],"euvd":[{"id":"EUVD-2026-31933","description":"The SAP Gateway allows attackers to inject content into error messages, potentially leading to disclosure of request artefacts (e.g., regex patterns) and revealing underlying URI parsing logic. Leading to low impact on confidentiality. Integrity and availability are unaffected.","status":"published","published":"2026-05-26T17:24:33Z","modified":"2026-05-26T18:36:16Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:21:06.423934Z"}],"ghsa":[{"id":"GHSA-53r4-mvj6-w855","title":"The SAP Gateway allows attackers to inject content into error messages, potentially leading to...","description":"The SAP Gateway allows attackers to inject content into error messages, potentially leading to disclosure of request artefacts (e.g., regex patterns) and revealing underlying URI parsing logic. Leading to low impact on confidentiality. Integrity and availability are unaffected.","status":"published","published":"2026-05-26T18:31:50Z","modified":"2026-05-26T18:31:58Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T15:08:18.762226Z"}],"nvd":[{"id":"CVE-2026-44749","description":"The SAP Gateway allows attackers to inject content into error messages, potentially leading to disclosure of request artefacts (e.g., regex patterns) and revealing underlying URI parsing logic. Leading to low impact on confidentiality. Integrity and availability are unaffected.","status":"published","published":"2026-05-26T18:16:51.19Z","modified":"2026-07-24T11:10:00.17Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T14:12:20.511562Z"}]}}