BSP CONSTRUCT_BSP_URL when ticket_only_by_https, SAP security note 1503491

SAP Note 1503491SAP Security NoteHigh priority

SAP security note 1503491, “BSP CONSTRUCT_BSP_URL when ticket_only_by_https”, is a program error note released on 14.12.2010. Below is the security information published by SAP for this note.

ComponentBusiness Server Pages (BC-BSP)

CategoryProgram error

PriorityCorrection with high priority

TypeSAP Security Note

Version2

StatusReleased for Customer

Released on14.12.2010

LanguageEnglish

Description

Symptom

BSP generates URLs with http even though login/ticket_only_by_https is set to 1.

Reason and prerequisites

There is no check on login/ticket_only_by_https when creating absolute URLs in BSP.

Solution

Import the Support Package specified below. Corrections from Note 1484557 are required.

Full note on SAP: SAP Support Launchpad note 1503491

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Business #Server #Pages #(BC-BSP)

Explore More

SAP Note 3765948: Code Injection via SSRF in SAP MII (CVE-2026-44772)

August 11, 2026

CVE-2026-44772, CVSS 9.9: XSL transform parameters let an authenticated user make SAP MII fetch and execute a remote stylesheet. The gate ships disabled.

SAP Note 3758900: Code Injection in SAP MII (CVE-2026-44758)

August 11, 2026

CVE-2026-44758, CVSS 9.1: the SAP MII IllumXSLTServlet compiled a caller supplied stylesheet. SAP removed the endpoint rather than patching it.

SAP Note 3759854: Directory Traversal in SAP MII (CVE-2026-44763)

August 11, 2026

CVE-2026-44763, CVSS 7.6: a save path in the SAP MII SSCE interface was assembled without containment, letting files land outside the intended folder.

SAP Note 3758657: Scheduling Authorization Gap, SAP MII (CVE-2026-44765)

August 11, 2026

CVE-2026-44765, CVSS 7.3: SAP MII scheduling functions were reachable without an authorization check. The fix adds guards and new role assignments.