CVEvulnerability

CVE-2021-33683

4.3 MEDIUM Published 2021-07-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-07-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 3.0 ([email protected])
5.4 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
Weaknesses
CWE-444

Description

SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, process invalid HTTP header. The incorrect handling of the invalid Transfer-Encoding header in a particular manner leads to a possibility of HTTP Request Smuggling attack. An attacker could exploit this vulnerability to bypass web application firewall protection, divert sensitive data such as customer requests, session credentials, etc.

Affected configurations

• sap web dispatcher 7.8 kernel 7.21 • sap web dispatcher 7.21ext • sap web dispatcher 7.22 • sap web dispatcher 7.22ext • sap web dispatcher 7.49 • sap web dispatcher 7.53 • sap web dispatcher 7.73 • sap web dispatcher 7.77 • sap web dispatcher 7.81 • sap web dispatcher 7.82 • sap web dispatcher krnl32nuc 7.21 • sap web dispatcher krnl32uc 7.21 • sap web dispatcher krnl64nuc 7.21 • sap web dispatcher krnl64uc 7.21 • sap web dispatcher webdisp 7.53 • sap internet communication manager 7.21ext • sap internet communication manager 7.22 • sap internet communication manager 7.22ext • sap internet communication manager 7.49 • sap internet communication manager 7.53 • sap internet communication manager 7.73 • sap internet communication manager 7.77 • sap internet communication manager 7.81 • sap internet communication manager 7.82 • sap internet communication manager kernel 7.21 • sap internet communication manager krnl32nuc 7.21 • sap internet communication manager krnl32uc 7.21 • sap internet communication manager krnl64nuc 7.21 • sap internet communication manager krnl64uc 7.21 • sap internet communication manager webdisp 7.53

Related

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References