3435724 - Prevent redirects with the logoff parameter redirecturl in Employee Central Payroll

The logoff parameter redirecturl can be used to redirect from an ECP system URL to a malicious URL. That is why security scans may mark the logoff parameter redirecturl as security vulnerability.

Example: https://<host>:<port>/sap/public/bc/icf/logoff?redirecturl=https://my.malicious.url

SAP SuccessFactors Employee Central Payroll

ICF, ICF logoff service vulnerability, redirecturl, HTTP_WHITELIST , KBA , LOD-EC-ECP-PY , Payroll Integration EC to Employee Central Payroll , LOD-EC-ECP-SF , Employee Central Payroll functionality part of SF , Problem