Description

SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks certain restrictive directives, which could enable an authenticated malicious user to leverage this weakness in combination with another vulnerability to inject and execute malicious scripts within the application's context. Successful exploitation may result in a low impact on confidentiality and integrity, with no impact on the availability of the application.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-11T01:17:20.800Z",
  "pubdate": "2026-08-11T01:17:20.800Z",
  "executiveSummary": "The SAP Data Services Management Console suffers from an overly permissive Content Security Policy (CSP) configuration alongside a lack of certain restrictive directives. This security shortcoming allows an authenticated malicious user to leverage this weakness in combination with another vulnerability to inject and execute arbitrary malicious scripts within the application context. The vulnerability affects the SAP Data Services Management Console product. Successful exploitation of this issue results in a low impact on data confidentiality and integrity, while maintaining no impact on the overall availability of the target application. Attack capabilities require the adversary to possess valid authentication credentials and necessitate chaining with an additional vulnerability to achieve successful script injection and execution. The risk implications are bounded by the requirement for prior authentication and secondary vulnerability prerequisites, yet the absence of a robust CSP weakens the defense-in-depth posture of the application against cross-site scripting and related client-side attack vectors.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure configuration of the Content Security Policy (CSP) implemented by the SAP Data Services Management Console. Specifically, the application deploys an overly permissive policy and fails to enforce critical restrictive directives required to mitigate client-side script injection risks. The vulnerable component is the HTTP response header handling mechanism responsible for enforcing the application's CSP within the web-based management interface.\nExploitation of this vulnerability requires the attacker to be an authenticated user with access to the SAP Data Services Management Console. Because the CSP lacks sufficient restrictions and permits overly broad sources or unsafe execution contexts, it fails to act as a reliable containment mechanism. Consequently, the attack flow requires the malicious user to identify and leverage a secondary vulnerability—such as a stored or reflected injection flaw—within the application context. By combining the secondary injection vector with the weak CSP configuration, the adversary bypasses client-side restrictions that would otherwise block the execution of unauthorized scripts.\nOnce the preliminary conditions are met, the payload behavior involves the injection of malicious script content into the application's DOM. Because the CSP does not adequately restrict script sources, unsafe-eval, or inline script execution directives, the browser executes the injected payload within the legitimate user session context. Post-exploitation impact remains constrained, resulting in a low impact on confidentiality and integrity, as the injected scripts execute within the privileges of the authenticated user session without compromising system availability or underlying server infrastructure. The network exposure is web-based, accessible wherever the management console interface is exposed to authenticated users."
}