Login Request a demo
Unscored severity · published Mar 7, 2006
CVE-2006-1039
SAP Web Application Server (WebAS) Kernel before 7.0 allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information, or…
–
CVSS
2.7%
EPSS
No
On KEV
Description
SAP Web Application Server (WebAS) Kernel before 7.0 allows remote attackers to inject arbitrary bytes into the HTTP response and obtain sensitive authentication information, or have other impacts, via a ";%20" followed by encoded HTTP headers.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SW
Sap Web Application Server · Sap
6.10; 6.20; 6.40 · source: NVD
Affected product
SW
Sap Web Application Server
Sap
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-1039
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-1039
Vendor Advisory
http://secunia.com/advisories/19085
securitytracker.com
http://securitytracker.com/id?1015702
www.securityfocus.com
http://www.securityfocus.com/archive/1/426449/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/18006
Vendor Advisory
http://www.vupen.com/english/advisories/2006/0810
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/25003
More from Sap Web Application Server
–
CVE-2008-2421
Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (aka WD4A or WDA), and Web Dynpro for BSP allows remote…
–
CVE-2007-3615
Internet Communication Manager (aka ICMAN.exe or ICM) in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remote attackers to cause a denial of…
–
CVE-2006-6010
SAP allows remote attackers to obtain potentially sensitive information such as operating system and SAP version via an RFC_SYSTEM_INFO RfcCallReceive request, a different…
–
CVE-2006-6011
Unspecified vulnerability in SAP Web Application Server before 6.40 patch 6 allows remote attackers to cause a denial of service (enserver.exe crash) via a certain UDP packet to…
–
CVE-2006-5784
Unspecified vulnerability in enserver.exe in SAP Web Application Server 6.40 before patch 136 and 7.00 before patch 66 allows remote attackers to read arbitrary files via crafted…