SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, process invalid HTTP header. The incorrect handling of the invalid Transfer-Encoding header in a particular manner leads to a possibility of HTTP Request Smuggling attack. An attacker could exploit this vulnerability to bypass web application firewall protection, divert sensitive data such as customer requests, session credentials, etc.
References
| Link | Resource |
|---|---|
| https://launchpad.support.sap.com/#/notes/3000663 | Permissions Required |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
28 Sep 2023, 15:51
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sap internet Communication Manager
Sap web Dispatcher |
|
| CPE | cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.22:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:krnl32uc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.49:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.81:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.73:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.21ext:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.82:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.22ext:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:webdisp_7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:krnl64uc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:krnl32nuc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.77:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:krnl64nuc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:kernel_7.21:*:*:*:*:*:*:* |
cpe:2.3:a:sap:internet_communication_manager:7.49:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:krnl64nuc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:webdisp_7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.49:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.82:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.21ext:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:krnl32nuc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.81:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.73:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.82:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:krnl64nuc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:kernel_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.8_kernel_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:krnl32uc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:krnl32uc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.21ext:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.22ext:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.22:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:webdisp_7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:krnl64uc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.22:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.77:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.81:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:krnl32nuc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.73:*:*:*:*:*:*:* |
Information
Published : 2021-07-14 12:15
Updated : 2024-02-28 18:28
NVD link : CVE-2021-33683
Mitre link : CVE-2021-33683
CVE.ORG link : CVE-2021-33683
JSON object : View
Products Affected
sap
- web_dispatcher
- internet_communication_manager
CWE
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')