Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2005-3634

6 documents6 sources
Severity
5.0MEDIUM
EPSS
1.7%
top 17.97%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
SAP SAP WEB Application Server
Timeline
PublishedNov 16
Latest updateMay 1

Description

frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter.

CVSS vector

AV:N/AC:L/C:N/I:P/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-8648-qmcx-pvc2: frameset↗2022-05-01
▶
CVEList
CVE-2005-3634: frameset↗2005-11-16
▶

💥Exploits & PoCs

2
Exploit-DB
SAP Web Application Server 6.x/7.0 - Open Redirection↗2005-11-09
▶
Nuclei
SAP Web Application Server 6.x/7.0 - Open Redirect
▶

📋Vendor Advisories

1
Red Hat
CVE-2007-3635: Multiple unspecified vulnerabilities in the G/PGP (GPG) Plugin before 2↗
▶