XXS vulnerability, SAP security note 985559

SAP Note 985559
SAP Security Note
Low priority

SAP security note 985559, "XXS vulnerability", was released on 08.10.2009. Below are the symptom, SAP recommended solution and the affected software components.

ComponentSAP Internet Transaction Server (BC-FES-ITS)

PriorityCorrection with low priority

TypeSAP Security Note

Version3

StatusReleased for Customer

Released on08.10.2009

Description

Symptom

There is an XSS vulnerability in the following error pages:

cmdinvalidcommand.html
cmdparameterinvalid.html
cmdparametermissing.html
commandexecfailed.html
invalidservice.html

Solution

The error was eliminated in ITS 6.20 Patch 23.

CVSS

Score 0

Affected components

BC-FES-ITS: 620 to 620

Full note on SAP: SAP Support Launchpad note 985559

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#BC-FES-ITS #ITS #XSS #Error Pages

Explore More

SAP Integration Suite and CAP Security Scan | RedRays

July 23, 2026

Product update Clean core is doing its job: custom logic keeps moving off the ABAP stack. But it does not disappear, it

SAP Security Patch Day July 2026 | RedRays

July 14, 2026

SAP has released its July 2026 security patch package containing 19 security notes addressing vulnerabilities across enterprise SAP environments. This release is

SAP Note 3704740: Missing Authorization Check (CVE-2026-27688)

July 6, 2026

SAP Security Note – Deep Dive SAP Note 3704740 closes a missing authorization check in SAP NetWeaver Application Server for ABAP that

SAP Note 3703856: Missing Authorization Check (CVE-2026-24309)

July 6, 2026

SAP Security Note – Patch Advisory SAP Note 3703856 fixes a missing authorization check in the SAP NetWeaver Application Server for ABAP.