CYBSEC Security Advisory – SAP Web Application Server was found to be vulnerable to JavaScript injection, allowing for Cross-Site Scripting attacks. Three different vectors for script injection where discovered.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/41436/CYBEC_Multiple_XSS_in_SAP_WAS.txt
Source: https://packetstormsecurity.com/files/41436/CYBEC_Multiple_XSS_in_SAP_WAS.txt.html