EUVD-2026-43592
GHSA-xfxh-3p9c-mww9
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
Authenticated low-privilege account required (PR:L), victim interaction mandatory (UI:R), browser scope change applies (S:C); description confirms no confidentiality or availability impact.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy (CSP) configuration for certain restrictive directives. This vulnerability has a low impact on the integrity of the application. Confidentiality and availability are not impacted.
AnalysisAI
Script injection in SAP CRM WebClient UI is enabled by absent Content Security Policy (CSP) directives for certain restrictive headers, allowing an authenticated low-privileged attacker to inject malicious JavaScript that executes in a victim user's browser session. The CVSS vector (PR:L/UI:R/S:C) confirms this requires both an authenticated attacker and victim interaction, with a cross-scope impact consistent with browser-context script execution. No public exploit code or CISA KEV active exploitation listing has been identified at time of analysis, and impact is bounded to low integrity with no confidentiality or availability consequence.
Technical ContextAI
SAP CRM WebClient UI is the browser-based front-end of SAP Customer Relationship Management, used widely in enterprise environments to manage customer interactions. The vulnerability arises from missing restrictive CSP directives - headers such as script-src or default-src that instruct browsers to block unauthorized inline or injected scripts. Without these controls, a browser will execute attacker-supplied JavaScript embedded in application-rendered content. The CPE string cpe:2.3:a:sap_se:sap_crm_(webclient_ui):*:*:*:*:*:*:*:* covers all versions with no version bounds, suggesting the CSP gap is architectural or configuration-level rather than isolated to a single code release. The assigned CWE-15 (External Control of System or Configuration Setting) is anomalous for this scenario - CWE-79 (Improper Neutralization of Input During Web Page Generation / XSS) or CWE-693 (Protection Mechanism Failure) would more precisely characterize a missing CSP control; this classification discrepancy should be noted when triaging. The CVSS Scope:Changed metric reflects that script execution escapes the vulnerable application component and operates within the victim's browser security context.
RemediationAI
Apply the corrective measures detailed in SAP Security Note 3155685 (https://me.sap.com/notes/3155685), which addresses the absent CSP configuration in SAP CRM WebClient UI. An exact patched version number is not confirmed from the available input data - the precise fix version must be verified directly from the SAP Note. As an interim compensating control, organizations can enforce a Content-Security-Policy response header at the network boundary using a WAF or reverse proxy, injecting restrictive directives such as script-src 'self'; note this approach risks breaking legitimate inline scripts within the WebClient UI and requires functional regression testing before deployment. Restricting access to the SAP CRM WebClient UI endpoint to internal or VPN-only networks reduces the AV:N exposure surface while awaiting the vendor patch, at the cost of remote access convenience for field users. Monitor SAP Security Patch Day (https://url.sap/sapsecuritypatchday) for updated guidance.
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today