Sign-up

ID

VAR-200511-0080


CVE

CVE-2005-3636


TITLE

SAP Web Application Server Error page cross-site scripting vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-200511-189

DESCRIPTION

Cross-site scripting (XSS) vulnerability in SAP Web Application Server (WAS) 6.10 allows remote attackers to inject arbitrary web script or HTML via Error Pages. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. This issue only affects the BSP runtime of SAP WAS. 1) Input passed to the "sap-syscmd" parameter in "fameset.htm" and the "BspApplication" field in the "SYSTEM PUBLIC" test application isn't properly sanitised before being returned to the user. Other versions may also be affected. 2) Input passed to the query string in pages generating error messages isn't properly sanitised before being returned to the user. Prior versions may also be affected. 3) The problem is that an absolute URL for an external site can be specified in the "sapexiturl" parameter passed to "fameset.htm". This can be exploited to trick users into visiting a malicious web site by following a specially crafted link with a trusted hostname redirecting to the malicious web site. Other versions may also be affected. This can be exploited to inject arbitrary HTTP headers, which will be included in the response sent to the user. Other versions may also be affected. SOLUTION: The vendor has reportedly provided a solution for the vulnerabilities. Customers should contact the SAP's support for further information. PROVIDED AND/OR DISCOVERED BY: Leandro Meiners, Cybsec S.A. ORIGINAL ADVISORY: http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_Multiple_XSS_in_SAP_WAS.pdf http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_Phishing_Vector_in_SAP_WAS.pdf http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_HTTP_Response_Splitting_in_SAP_WAS.pdf ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.26

sources: NVD: CVE-2005-3636 // BID: 15361 // PACKETSTORM: 41457

AFFECTED PRODUCTS

vendor:sapmodel:web application serverscope:eqversion:6.10

Trust: 1.9

vendor:sapmodel:web application serverscope:eqversion:7.0

Trust: 0.3

vendor:sapmodel:web application serverscope:eqversion:6.40

Trust: 0.3

vendor:sapmodel:web application serverscope:eqversion:6.20

Trust: 0.3

sources: BID: 15361 // NVD: CVE-2005-3636 // CNNVD: CNNVD-200511-189

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2005-3636
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-200511-189
value: MEDIUM

Trust: 0.6

NVD:
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: FALSE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: FALSE
version: 2.0

Trust: 1.0

sources: NVD: CVE-2005-3636 // CNNVD: CNNVD-200511-189

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2005-3636

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200511-189

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-200511-189

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2005-3636

EXTERNAL IDS
db:BIDid:15361
Trust: 1.9
db:SECUNIAid:17515
Trust: 1.7
db:SREASONid:162
Trust: 1.6
db:SECTRACKid:1015174
Trust: 1.6
db:VUPENid:ADV-2005-2361
Trust: 1.6
db:OSVDBid:20715
Trust: 1.6
db:NVDid:CVE-2005-3636
Trust: 1.6
db:BUGTRAQid:20051109 CYBSEC - SECURITY ADVISORY: MULTIPLE XSS IN SAP WAS
Trust: 0.6
db:XFid:23029
Trust: 0.6
db:CNNVDid:CNNVD-200511-189
Trust: 0.6
db:PACKETSTORMid:41457
Trust: 0.1
sources:
            
            
            BID: 15361 // 
            
            
            
            PACKETSTORM: 41457 // 
            
            
            
            NVD: CVE-2005-3636 // 
            
            
            
            CNNVD: CNNVD-200511-189

REFERENCES
url:http://www.cybsec.com/vuln/cybsec_security_advisory_multiple_xss_in_sap_was.pdf
Trust: 1.7
url:http://secunia.com/advisories/17515/
Trust: 1.7
url:http://securityreason.com/securityalert/162
Trust: 1.6
url:http://www.osvdb.org/20715
Trust: 1.6
url:http://www.securityfocus.com/bid/15361
Trust: 1.6
url:http://www.securitytracker.com/alerts/2005/nov/1015174.html
Trust: 1.6
url:http://marc.info/?l=bugtraq&m=113156601505542&w=2
Trust: 1.0
url:http://www.vupen.com/english/advisories/2005/2361
Trust: 1.0
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/23029
Trust: 1.0
url:http://marc.theaimsgroup.com/?l=bugtraq&m=113156601505542&w=2
Trust: 0.6
url:http://xforce.iss.net/xforce/xfdb/23029
Trust: 0.6
url:http://www.frsirt.com/english/advisories/2005/2361
Trust: 0.6
url:http://www.sap.com
Trust: 0.3
url:/archive/1/416151
Trust: 0.3
url:http://secunia.com/product/6087/
Trust: 0.1
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
url:http://www.cybsec.com/vuln/cybsec_security_advisory_phishing_vector_in_sap_was.pdf
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/product/3327/
Trust: 0.1
url:http://www.cybsec.com/vuln/cybsec_security_advisory_http_response_splitting_in_sap_was.pdf
Trust: 0.1
sources:
            
            
            BID: 15361 // 
            
            
            
            PACKETSTORM: 41457 // 
            
            
            
            NVD: CVE-2005-3636 // 
            
            
            
            CNNVD: CNNVD-200511-189

CREDITS
Leandro Meiners
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200511-189

SOURCES
db:BIDid:15361
db:PACKETSTORMid:41457
db:NVDid:CVE-2005-3636
db:CNNVDid:CNNVD-200511-189

LAST UPDATE DATE
2023-12-18T12:53:36.465000+00:00

SOURCES UPDATE DATE
db:BIDid:15361date:2005-11-09T00:00:00
db:NVDid:CVE-2005-3636date:2017-07-11T01:33:15.690
db:CNNVDid:CNNVD-200511-189date:2005-11-23T00:00:00

SOURCES RELEASE DATE
db:BIDid:15361date:2005-11-09T00:00:00
db:PACKETSTORMid:41457date:2005-11-10T23:56:45
db:NVDid:CVE-2005-3636date:2005-11-16T21:22:00
db:CNNVDid:CNNVD-200511-189date:2005-11-16T00:00:00