Skip links
Book a demo
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

BSP CONSTRUCT_BSP_URL when ticket_only_by_https, SAP security note 1503491

SAP Note 1503491SAP Security NoteHigh priority

SAP security note 1503491, “BSP CONSTRUCT_BSP_URL when ticket_only_by_https”, is a program error note released on 14.12.2010. Below is the security information published by SAP for this note.

ComponentBusiness Server Pages (BC-BSP)
CategoryProgram error
PriorityCorrection with high priority
TypeSAP Security Note
Version2
StatusReleased for Customer
Released on14.12.2010
LanguageEnglish

Description

Symptom

BSP generates URLs with http even though login/ticket_only_by_https is set to 1.

Reason and prerequisites

There is no check on login/ticket_only_by_https when creating absolute URLs in BSP.

Solution

Import the Support Package specified below. Corrections from Note 1484557 are required.

Full note on SAP: SAP Support Launchpad note 1503491

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Business#Server#Pages#(BC-BSP)

Explore More

SAP Security Patch Day November 2026 — RedRays

SAP Security Patch Day November 2026

November 10, 2026

SAP’s November 2026 Patch Day brings 38 notes, nine HotNews and four CVSS 10.0 issues in SAML2, SAP Gateway, Web Dispatcher and ICM. What to patch first.