3435724 - Prevent redirects with the logoff parameter redirecturl in Employee Central Payroll

The logoff parameter redirecturl can be used to redirect from an ECP system URL to a malicious URL. That is why security scans may mark the logoff parameter redirecturl as security vulnerability.

Example: https://<host>:<port>/sap/public/bc/icf/logoff?redirecturl=https://my.malicious.url

• Employee Central Payroll (ECP)

ICF, ICF logoff service vulnerability, redirecturl, HTTP_WHITELIST , KBA , LOD-EC-GCP-PY , Payroll Integration EC to Employee Central Payroll , Problem