EUVD-2026-55862
GHSA-x3p8-w664-v5hj
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Network-accessible console, but chaining requirement and mandatory user interaction justify AC:H and UI:R; authenticated low-privilege access required; no availability impact applies.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
1DescriptionCVE.org
SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks certain restrictive directives, which could enable an authenticated malicious user to leverage this weakness in combination with another vulnerability to inject and execute malicious scripts within the application's context. Successful exploitation may result in a low impact on confidentiality and integrity, with no impact on the availability of the application.
AnalysisAI
SAP Data Services Management Console versions 4.3 and 2025 expose an overly permissive Content Security Policy that omits key restrictive directives, creating a prerequisite condition for script injection attacks within the application context. An authenticated attacker who also controls or exploits a separate vulnerability - such as a stored or reflected XSS vector - can leverage the absent CSP controls to execute malicious scripts in a victim user's browser session. Confidentiality and integrity suffer limited impact; availability is unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
Content Security Policy (CSP) is a browser-enforced HTTP response header mechanism that restricts which sources can execute scripts, load frames, or inject content into a page. When directives such as script-src, default-src, or frame-ancestors are absent or overly broad, the browser applies no meaningful restrictions, negating the primary defense against cross-site scripting and UI-redressing attacks. CWE-1021 - Improper Restriction of Rendered UI Layers or Frames - identifies the root cause class here: the application fails to constrain how its own rendered interface can be overlaid or manipulated by injected content. The affected product, identified via CPE cpe:2.3:a:sap_se:sap_data_services_management_console:*:*:*:*:*:*:*:*, is SAP's browser-based management console for its Data Services ETL and data integration platform, deployed on-premise in SAP enterprise environments. The tagging of XSS alongside CWE-1021 suggests the CSP gap is the enabler for script injection rather than a standalone UI-redressing flaw.
RemediationAI
The primary remediation is to apply the fix documented in SAP Security Note 3739913, available at https://me.sap.com/notes/3739913, which should introduce corrective CSP directives for the Management Console. Customers should review the SAP Security Patch Day guidance at https://url.sap/sapsecuritypatchday for scheduling context. An exact patched version number is not independently confirmed from available intelligence beyond the note reference - customers should verify the corrected build identifier directly from the SAP Support Portal before deployment. As a compensating control prior to patching, network access to the Management Console should be restricted to trusted internal segments or VPN-only access, reducing the exposed attack surface for any chained XSS scenario. Browser-level policy enforcement via web application firewall rules that inject or enforce a strict CSP header (e.g., script-src 'self'; frame-ancestors 'none') at the reverse proxy layer is a viable interim measure, though it may interfere with legitimate console functionality and requires testing before broad deployment.
Share
External POC / Exploit Code
Leaving vuln.today