SAP Note 2684760 – [CVE-2018-2470] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP Business Server Pages
Version 8 from 18.10.2018
The header “X-Content-Type-Options” is not set. It can lead to MIME Sniffing Attacks.
Solution
“X-Content-Type-Options” is added to HTTP header of BSP and is set to “nosniff” for MIME objects.