漏洞描述
frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
cxsecurity.comhttps://cxsecurity.com/issue/WLB-2005110025↗marc.infohttps://marc.info/?l=bugtraq&m=113156525006667&w=2↗www.cybsec.comhttp://www.cybsec.com/vuln/CYBSEC_Security_Advisory_Multiple_XSS_in_SAP_WAS.pdf↗exchange.xforce.ibmcloud.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/23031↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2005-3634↗