SAP Security Note
High priority
SAP security note 1391770, "Error in Open SQL monitors servlet application", is a program error note released on 26.04.2010. Below are the symptom and SAP recommended solution.
Description
Symptom
There was a security breach in the Open SQL monitors servlet application due to possible cross-site scripting (XSS) attacks.
Solution
Import the relevant Support Package to address the vulnerability.
Reason and prerequisites
A security breach occurred in the Open SQL monitors servlet application. User data was accepted without proper validation and then forwarded to the browser, making the application susceptible to reflexive XSS attacks.
Full note on SAP: SAP Support Launchpad note 1391770
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].