Security Scan and XSS Vulnerabilities, SAP security note 1097591

SAP Note 1097591
SAP Security Note
High Priority

SAP security note 1097591, "Security Scan and XSS Vulnerabilities", is a program error note released on January 7, 2010. Below are the symptom and SAP recommended solution.

ComponentEnterprise Portal Development Kit (EP-PDK) > HTMLB Business for Java (EP-PDK-HBJ)

CategoryProgram Error

PriorityHigh Priority

TypeSAP Security Note

Version2

StatusReleased for Customer

Released onJanuary 7, 2010

Description

Symptom

The HTMLB header parameters were vulnerable to Cross-Site Scripting (XSS) vulnerabilities.

Solution

This issue has been fixed. Please refer to SAP Note 1109755 for more details.

Reason and prerequisites

The vulnerability arose because the parameters were not properly encoded.

Full note on SAP: SAP Support Launchpad note 1097591

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Enterprise Portal Development Kit #EP-PDK #HTMLB Business for Java #EP-PDK-HBJ

Explore More

SAP Integration Suite and CAP Security Scan | RedRays

July 23, 2026

Product update Clean core is doing its job: custom logic keeps moving off the ABAP stack. But it does not disappear, it

SAP Security Patch Day July 2026 | RedRays

July 14, 2026

SAP has released its July 2026 security patch package containing 19 security notes addressing vulnerabilities across enterprise SAP environments. This release is

SAP Note 3704740: Missing Authorization Check (CVE-2026-27688)

July 6, 2026

SAP Security Note – Deep Dive SAP Note 3704740 closes a missing authorization check in SAP NetWeaver Application Server for ABAP that

SAP Note 3703856: Missing Authorization Check (CVE-2026-24309)

July 6, 2026

SAP Security Note – Patch Advisory SAP Note 3703856 fixes a missing authorization check in the SAP NetWeaver Application Server for ABAP.