CVE-2005-3633 - Vulnerability Details - OpenCVE

HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Sap	Sap Web Application Server

Configuration 1 [-]

OR	cpe:2.3:a:sap:sap_web_application_server:6.10:::::::*
	cpe:2.3:a:sap:sap_web_application_server:6.20:::::::*
	cpe:2.3:a:sap:sap_web_application_server:6.40:::::::*
	cpe:2.3:a:sap:sap_web_application_server:7.0:::::::*

No data.

References

Link	Providers
http://marc.info/?l=bugtraq&m=113156438708932&w=2
http://secunia.com/advisories/17515/
http://securityreason.com/securityalert/164
http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_HTTP_Response_Splitting_in_SAP_WAS.pdf
http://www.osvdb.org/20714
http://www.securityfocus.com/bid/15360/
http://www.securitytracker.com/alerts/2005/Nov/1015174.html
http://www.vupen.com/english/advisories/2005/2361
https://exchange.xforce.ibmcloud.com/vulnerabilities/23030

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2005-11-16T21:17:00

Updated: 2024-08-07T23:17:23.899Z

Reserved: 2005-11-16T00:00:00

Link: CVE-2005-3633

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2005-11-16T21:22:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2005-3633

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2005-11-09T00:00:00", "descriptions": [{"lang": "en", "value": "HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-10T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20051109 CYBSEC - Security Advisory: HTTP Response Splitting in SAP WAS", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://marc.info/?l=bugtraq&m=113156438708932&w=2"}, {"name": "sap-sapexiturl-response-splitting(23030)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23030"}, {"tags": ["x_refsource_MISC"], "url": "http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_HTTP_Response_Splitting_in_SAP_WAS.pdf"}, {"name": "164", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/164"}, {"name": "20714", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/20714"}, {"name": "17515", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/17515/"}, {"name": "1015174", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/alerts/2005/Nov/1015174.html"}, {"name": "ADV-2005-2361", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2005/2361"}, {"name": "15360", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/15360/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2005-3633", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20051109 CYBSEC - Security Advisory: HTTP Response Splitting in SAP WAS", "refsource": "BUGTRAQ", "url": "http://marc.info/?l=bugtraq&m=113156438708932&w=2"}, {"name": "sap-sapexiturl-response-splitting(23030)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23030"}, {"name": "http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_HTTP_Response_Splitting_in_SAP_WAS.pdf", "refsource": "MISC", "url": "http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_HTTP_Response_Splitting_in_SAP_WAS.pdf"}, {"name": "164", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/164"}, {"name": "20714", "refsource": "OSVDB", "url": "http://www.osvdb.org/20714"}, {"name": "17515", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/17515/"}, {"name": "1015174", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/alerts/2005/Nov/1015174.html"}, {"name": "ADV-2005-2361", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2005/2361"}, {"name": "15360", "refsource": "BID", "url": "http://www.securityfocus.com/bid/15360/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T23:17:23.899Z"}, "title": "CVE Program Container", "references": [{"name": "20051109 CYBSEC - Security Advisory: HTTP Response Splitting in SAP WAS", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=113156438708932&w=2"}, {"name": "sap-sapexiturl-response-splitting(23030)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23030"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_HTTP_Response_Splitting_in_SAP_WAS.pdf"}, {"name": "164", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/164"}, {"name": "20714", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/20714"}, {"name": "17515", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/17515/"}, {"name": "1015174", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/alerts/2005/Nov/1015174.html"}, {"name": "ADV-2005-2361", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2005/2361"}, {"name": "15360", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/15360/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2005-3633", "datePublished": "2005-11-16T21:17:00", "dateReserved": "2005-11-16T00:00:00", "dateUpdated": "2024-08-07T23:17:23.899Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:sap_web_application_server:6.10:*:*:*:*:*:*:*", "matchCriteriaId": "FE5FAC41-5C2B-4653-A757-ADBFD37E716E", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:sap_web_application_server:6.20:*:*:*:*:*:*:*", "matchCriteriaId": "A68E0969-971D-4D97-97EE-F901B05885DC", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:sap_web_application_server:6.40:*:*:*:*:*:*:*", "matchCriteriaId": "B41DF7D3-9EF1-4F5B-870E-5D1FDF095509", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:sap_web_application_server:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "5F89AF4D-B15A-4D91-B6A4-0A206772BC69", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter."}, {"lang": "es", "value": "Vulnerabilidad de separaci\u00f3n de respuesta HTTP en frameset.htm de SAP Web Application Server (WAS) 6.10 a 7.00 permite a atacantes remotos inyectar cabeceras HTML de su elecci\u00f3n mediante el par\u00e1metro sap-exiturl."}], "id": "CVE-2005-3633", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2005-11-16T21:22:00.000", "references": [{"source": "cve@mitre.org", "url": "http://marc.info/?l=bugtraq&m=113156438708932&w=2"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/17515/"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/164"}, {"source": "cve@mitre.org", "url": "http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_HTTP_Response_Splitting_in_SAP_WAS.pdf"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/20714"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/15360/"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Vendor Advisory"], "url": "http://www.securitytracker.com/alerts/2005/Nov/1015174.html"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2005/2361"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23030"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=bugtraq&m=113156438708932&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/17515/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/164"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_HTTP_Response_Splitting_in_SAP_WAS.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/20714"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/15360/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "http://www.securitytracker.com/alerts/2005/Nov/1015174.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2005/2361"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23030"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}