Log in Start free

Vulnerability · Published Jul 14, 2021 · Assigned by sap

CVE-2021-33683

Medium 5.4

In plain English

A medium-severity security flaw in SAP Web Dispatcher and Internet Communication Manager from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.0)5.4Medium
Exploit odds (30 days)0.5%top 54.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, process invalid HTTP header. The incorrect handling of the invalid Transfer-Encoding header in a particular manner leads to a possibility of HTTP Request Smuggling attack. An attacker could exploit this vulnerability to bypass web application firewall protection, divert sensitive data such as customer requests, session credentials, etc.

Affected products (as reported)

VendorProductVersions
SAP SE SAP Web Dispatcher and Internet Communication Manager < KRNL32NUC 7.21< 7.21EXT< 7.22< 7.22EXT< KRNL32UC 7.21< KRNL64NUC 7.21< 7.49< KRNL64UC 7.21

Weakness: CWE-444 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References