CVE-2005-3634 frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-s...
MediumCVSS 5.0
EPSS 17.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sap web application server | = 6.10 | No fix listed |
| sap web application server | = 6.20 | No fix listed |
| sap web application server | = 6.40 | No fix listed |
| sap web application server | = 7.0 | No fix listed |
References
- 20051109 CYBSEC - Security Advisory: Phishing Vector in SAP WAS mailing-list
- 17515 third-party-advisory vendor-advisory
- 163 third-party-advisory
- www.cybsec.com
- 15362 exploit vdb-entry
- 1015174 vdb-entry vendor-advisory
- ADV-2005-2361 vdb-entry
- sap-sapexiturl-http-header-injection(23031) vdb-entry