SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.53, KERNEL - 7.22, 7.49, 7.53, 7.77, 7.81, 7.83 processes allow an unauthenticated attacker to submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify any information on the server or consume server resources making it temporarily unavailable.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/166964/SAP-Web-Dispatcher-HTTP-Request-Smuggling.html | Exploit Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2022/May/3 | Exploit Mailing List Third Party Advisory |
| https://launchpad.support.sap.com/#/notes/3080567 | Permissions Required |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
10 Jul 2023, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.53, KERNEL - 7.22, 7.49, 7.53, 7.77, 7.81, 7.83 processes allow an unauthenticated attacker to submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify any information on the server or consume server resources making it temporarily unavailable. |
06 Oct 2022, 03:06
| Type | Values Removed | Values Added |
|---|---|---|
| References | (FULLDISC) http://seclists.org/fulldisclosure/2022/May/3 - Exploit, Mailing List, Third Party Advisory | |
| References | (MISC) http://packetstormsecurity.com/files/166964/SAP-Web-Dispatcher-HTTP-Request-Smuggling.html - Exploit, Third Party Advisory, VDB Entry |
05 May 2022, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
04 May 2022, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
24 Sep 2021, 15:27
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://launchpad.support.sap.com/#/notes/3080567 - Permissions Required | |
| References | (MISC) https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.4 |
| CPE | cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:kernel_7.22:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:krnl64nuc_7.22:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.22:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.83:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.49:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.81:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:* |
|
| CWE | CWE-444 |
14 Sep 2021, 13:01
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-09-14 12:15
Updated : 2023-12-10 14:09
NVD link : CVE-2021-38162
Mitre link : CVE-2021-38162
CVE.ORG link : CVE-2021-38162
JSON object : View
Products Affected
sap
- web_dispatcher
CWE
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')