SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, process invalid HTTP header. The incorrect handling of the invalid Transfer-Encoding header in a particular manner leads to a possibility of HTTP Request Smuggling attack. An attacker could exploit this vulnerability to bypass web application firewall protection, divert sensitive data such as customer requests, session credentials, etc.
References
| Link | Resource |
|---|---|
| https://launchpad.support.sap.com/#/notes/3000663 | Permissions Required |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 | Vendor Advisory |
| https://launchpad.support.sap.com/#/notes/3000663 | Permissions Required |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 06:09
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://launchpad.support.sap.com/#/notes/3000663 - Permissions Required | |
| References | () https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 - Vendor Advisory |
28 Sep 2023, 15:51
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sap web Dispatcher
Sap internet Communication Manager |
|
| CPE | cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.82:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.22ext:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:webdisp_7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:krnl64nuc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.21ext:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.81:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:krnl32uc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.73:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.77:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.22:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:krnl64uc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:kernel_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher_and_internet_communication_manager:7.49:*:*:*:*:*:*:* |
cpe:2.3:a:sap:web_dispatcher:webdisp_7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.21ext:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:krnl32nuc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.49:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:krnl32nuc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.81:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.82:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:krnl32uc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.22:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:krnl64nuc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:krnl32uc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.49:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.22:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.82:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:webdisp_7.53:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:krnl64uc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.21ext:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.73:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.77:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:kernel_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.81:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.73:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:7.22ext:*:*:*:*:*:*:* cpe:2.3:a:sap:web_dispatcher:7.8_kernel_7.21:*:*:*:*:*:*:* cpe:2.3:a:sap:internet_communication_manager:krnl64nuc_7.21:*:*:*:*:*:*:* |
Information
Published : 2021-07-14 12:15
Updated : 2024-11-21 06:09
NVD link : CVE-2021-33683
Mitre link : CVE-2021-33683
CVE.ORG link : CVE-2021-33683
JSON object : View
Products Affected
sap
- web_dispatcher
- internet_communication_manager
CWE
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')