SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a…
sap·CWE-15·Published 2026-07-14
SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy (CSP) configuration for certain restrictive directives. This vulnerability has a low impact on the integrity of the application. Confidentiality and availability are not impacted.
SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy (CSP) configuration for certain restrictive directives. This vulnerability has a low impact on the integrity of the application. Confidentiality and availability are not impacted.
SAP CRM WebClient UI permite a un atacante inyectar y ejecutar scripts maliciosos en el contexto de la aplicación debido a la ausencia de una configuración de Política de Seguridad de Contenido (CSP) para ciertas directivas restrictivas. Esta vulnerabilidad tiene un impacto bajo en la integridad de la aplicación. La confidencialidad y la disponibilidad no se ven impactadas.
| Version | Type | Source | Base | Exp | Impact | Vector |
|---|---|---|---|---|---|---|
| 3.1 | Primary | NVD | 4.1 | 2.3 | 1.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N |
| 3.1 | Primary | cve.org | 4.1 | — | — | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N |
| 3.1 | Secondary | NVD | 4.1 | 2.3 | 1.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N |
| 3.1 | Secondary | ENISA EUVD | 4.1 | — | — | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N |