SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, process invalid HTTP header. The incorrect handling of the invalid Transfer-Encoding header in a particular manner leads to a possibility of HTTP Request Smuggling attack. An attacker could exploit this vulnerability to bypass web application firewall protection, divert sensitive data such as customer requests, session credentials, etc.
References
| Link | Resource |
|---|---|
| https://launchpad.support.sap.com/#/notes/3000663 | Permissions Required |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
28 Sep 2023, 15:51
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sap web Dispatcher
Sap internet Communication Manager |
|
| CPE | cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:webdisp_7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.77:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.73:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.82:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:krnl32nuc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.22ext:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.81:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:krnl32uc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.21ext:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.22:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:krnl64nuc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:krnl64uc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:kernel_7.21:*:*:*:*:*:*:* |
cpe:2.3:a:sap:web_dispatcher:krnl32nuc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.21ext:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:webdisp_7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:krnl64nuc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.82:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:krnl32uc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.49:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:krnl32nuc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:krnl64uc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:krnl32uc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:krnl64nuc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.73:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.22ext:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.21ext:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.22:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.81:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.49:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.8_kernel_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:webdisp_7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.22:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.82:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:kernel_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.77:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.73:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.81:*:*:*:*:*:*:* |
27 Jul 2021, 14:22
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 4.3 |
| CWE | CWE-444 | |
| References | (MISC) https://launchpad.support.sap.com/#/notes/3000663 - Permissions Required | |
| References | (MISC) https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 - Vendor Advisory | |
| CPE | cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:krnl64uc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.22ext:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.49:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.21ext:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.73:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.77:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.81:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:kernel_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:krnl32nuc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:krnl64nuc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.82:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.22:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:webdisp_7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:krnl32uc_7.21:*:*:*:*:*:*:* |
14 Jul 2021, 12:24
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-07-14 12:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-33683
Mitre link : CVE-2021-33683
CVE.ORG link : CVE-2021-33683
JSON object : View
Products Affected
sap
- internet_communication_manager
- web_dispatcher
CWE
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')