Scribd
Upload
114 views1 page

AS Java Security Vulnerability The Server Is Not Configured

The document discusses a security vulnerability where a server is not configured to return an X-XSS-Protection header, making pages vulnerable to cross-site scripting attacks. The resolution is to adjust web container properties to include the X-XSS-Protection header with a value of 1; mode=block. The document provides details on the symptom, environment, cause, resolution, and references related products and notes.

Uploaded by

Eugene
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
114 views1 page

AS Java Security Vulnerability The Server Is Not Configured

The document discusses a security vulnerability where a server is not configured to return an X-XSS-Protection header, making pages vulnerable to cross-site scripting attacks. The resolution is to adjust web container properties to include the X-XSS-Protection header with a value of 1; mode=block. The document provides details on the symptom, environment, cause, resolution, and references related products and notes.

Uploaded by

Eugene
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 1

SAP Knowledge Base Article

3385187 - AS Java Security Vulnerability - The server is not configured to return a 'X-
XSS-Protection' header
Component: BC-JAS-WEB (Web Container, HTTP, JavaMail, Servlets), Version: 1, Released On: 04.10.2023

Symptom
Third party tool detects security vulnerability that the server is not configured to return a 'X-XSS-Protection' header which
means that any pages on this website could be at risk of a Cross-Site Scripting (XSS) attack.

Environment
SAP NetWeaver for Application Server Java - all versions

Cause
Web container does not include an 'X-XSS-Protection' header with a value of '1; mode=block' on all pages.

Resolution
Adjust this property on global Web Container level. Make sure that your system is on the version that allows this feature and
implement custom header. See more in SAP Note: 1831525 - Custom Headers Feature.
Name and value must be:
headername=X-XSS-Protection
headervalue=1; mode=block

Attributes
Key Value

Requires Action 0

Products
Products

SAP NetWeaver Application Server for Java all versions

This document is referenced by


SAP Note/KBA Title

You might also like