The SAP Data Services Management Console has an improper restriction of rendered UI layers or frames due to an overly permissive Content Security Policy configuration and missing restrictive directives. This weakness could be exploited by an authenticated attacker in combination with another vulnerability to inject and execute malicious scripts within the application context. The CVSS 3.1 base score is 3.7, indicating low severity, with attack vector network, high attack complexity, low privileges required, and user interaction required. The impact is limited to confidentiality and integrity with no availability impact.

Successful exploitation may lead to limited disclosure or modification of information within the application context but does not affect application availability. The impact is considered low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor SAP advisories for updates and consider minimizing privileges and user interaction where possible.