CVE-2005-3633: SAP Web Application Server

Medium severity, CVSS 5.0. EPSS: 2% chance of exploitation in the next 30 days.

HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter.

Affected products

• SAP SAP Web Application Server: version 6.10 only; version 6.20 only; version 6.40 only; version 7.0 only

Published 2005-11-16. Last modified 2026-06-16.