VulnerabilityModified
CVE-2006-1039
SAP Web Application Server (WebAS) Kernel before 7.0 allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information, or have other impacts, via a ";%20" followed by encoded HTTP headers.
MEDIUM 6.4EPSS 2.74%
Does this matter?
Lower severity and a low EPSS score (2.74%). Track it; it rarely justifies an emergency change on its own.
Description
SAP Web Application Server (WebAS) Kernel before 7.0 allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information, or have other impacts, via a ";%20" followed by encoded HTTP headers.
- CVSS 2.0
- 6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
- EPSS
- 2.74% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- sap/sap web application server
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/19085Vendor Advisory
- http://securitytracker.com/id?1015702
- http://www.securityfocus.com/archive/1/426449/100/0/threaded
- http://www.securityfocus.com/bid/18006
- http://www.vupen.com/english/advisories/2006/0810Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25003
- http://secunia.com/advisories/19085Vendor Advisory
- http://securitytracker.com/id?1015702
- http://www.securityfocus.com/archive/1/426449/100/0/threaded
- http://www.securityfocus.com/bid/18006
- http://www.vupen.com/english/advisories/2006/0810Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25003
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.