SAP CRM WebClient UI versions 105 and 106 lack a properly configured Content Security Policy (CSP) for certain restrictive directives, enabling an attacker with low privileges and requiring user interaction to inject and execute malicious scripts within the application context. This vulnerability is classified under CWE-15 (External Control of System or Configuration Setting) and has a CVSS 3.1 base score of 4.1, indicating a medium severity impact primarily on the integrity of the application. Confidentiality and availability are not impacted. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

The vulnerability allows modification of system or configuration settings related to script execution, leading to potential integrity compromise of the SAP CRM WebClient UI application. However, it does not affect the confidentiality of data or the availability of the system. The attack requires network access, low attack complexity, privileges, and user interaction, limiting its exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or mitigation is provided by SAP, organizations should consider restricting user privileges, monitoring for suspicious script activity, and applying compensating controls to limit the impact of script injection. No vendor advisory or official fix is currently available.