EUVD-2026-55862
GHSA-x3p8-w664-v5hj
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Network-accessible console, but chaining requirement and mandatory user interaction justify AC:H and UI:R; authenticated low-privilege access required; no availability impact applies.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
1DescriptionCVE.org
SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks certain restrictive directives, which could enable an authenticated malicious user to leverage this weakness in combination with another vulnerability to inject and execute malicious scripts within the application's context. Successful exploitation may result in a low impact on confidentiality and integrity, with no impact on the availability of the application.
AnalysisAI
SAP Data Services Management Console versions 4.3 and 2025 expose an overly permissive Content Security Policy that omits key restrictive directives, creating a prerequisite condition for script injection attacks within the application context. An authenticated attacker who also controls or exploits a separate vulnerability - such as a stored or reflected XSS vector - can leverage the absent CSP controls to execute malicious scripts in a victim user's browser session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold an authenticated low-privilege account on SAP Data Services Management Console (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 3.7 (Low) with vector AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N accurately reflects the constrained exploitability of this issue: high attack complexity is warranted because the CSP weakness cannot be exploited in isolation - it requires chaining with a separate vulnerability to achieve script injection. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the fix documented in SAP Security Note 3739913, available at https://me.sap.com/notes/3739913, which should introduce corrective CSP directives for the Management Console. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today