Lucene search

SapCVE-2021-38162

HistorySep 14, 2021 - 12:15 p.m.

CVE-2021-38162

2021-09-1412:15:10

CWE-444

sap

web.nvd.nist.gov

sap

web dispatcher

cve

security

vulnerability

exploitation

unauthenticated access

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

AI Score

Confidence

High

EPSS

0.043

Percentile

92.4%

JSON

SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.53, KERNEL - 7.22, 7.49, 7.53, 7.77, 7.81, 7.83 processes allow an unauthenticated attacker to submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify any information on the server or consume server resources making it temporarily unavailable.

Affected configurations

Nvd

Node

sapweb_dispatcherMatch7.22ext

sapweb_dispatcherMatch7.49

sapweb_dispatcherMatch7.53

sapweb_dispatcherMatch7.77

sapweb_dispatcherMatch7.81

sapweb_dispatcherMatch7.83

sapweb_dispatcherMatchkernel_7.22

sapweb_dispatcherMatchkrnl64nuc_7.22

sapweb_dispatcherMatchkrnl64uc_7.22

VendorProductVersionCPE
sapweb_dispatcher7.22extcpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:*
sapweb_dispatcher7.49cpe:2.3:a:sap:web_dispatcher:7.49:*:*:*:*:*:*:*
sapweb_dispatcher7.53cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:*
sapweb_dispatcher7.77cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:*
sapweb_dispatcher7.81cpe:2.3:a:sap:web_dispatcher:7.81:*:*:*:*:*:*:*
sapweb_dispatcher7.83cpe:2.3:a:sap:web_dispatcher:7.83:*:*:*:*:*:*:*
sapweb_dispatcherkernel_7.22cpe:2.3:a:sap:web_dispatcher:kernel_7.22:*:*:*:*:*:*:*
sapweb_dispatcherkrnl64nuc_7.22cpe:2.3:a:sap:web_dispatcher:krnl64nuc_7.22:*:*:*:*:*:*:*
sapweb_dispatcherkrnl64uc_7.22cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.22:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	web_dispatcher	7.22ext	cpe:2.3:a:sap:web_dispatcher:7.22ext:::::::*
sap	web_dispatcher	7.49	cpe:2.3:a:sap:web_dispatcher:7.49:::::::*
sap	web_dispatcher	7.53	cpe:2.3:a:sap:web_dispatcher:7.53:::::::*
sap	web_dispatcher	7.77	cpe:2.3:a:sap:web_dispatcher:7.77:::::::*
sap	web_dispatcher	7.81	cpe:2.3:a:sap:web_dispatcher:7.81:::::::*
sap	web_dispatcher	7.83	cpe:2.3:a:sap:web_dispatcher:7.83:::::::*
sap	web_dispatcher	kernel_7.22	cpe:2.3:a:sap:web_dispatcher:kernel_7.22:::::::*
sap	web_dispatcher	krnl64nuc_7.22	cpe:2.3:a:sap:web_dispatcher:krnl64nuc_7.22:::::::*
sap	web_dispatcher	krnl64uc_7.22	cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.22:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP Web Dispatcher",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "WEBDISP - 7.49"
      },
      {
        "status": "affected",
        "version": "7.53"
      },
      {
        "status": "affected",
        "version": "7.77"
      },
      {
        "status": "affected",
        "version": "7.81"
      },
      {
        "status": "affected",
        "version": "KRNL64NUC - 7.22"
      },
      {
        "status": "affected",
        "version": "7.22EXT"
      },
      {
        "status": "affected",
        "version": "7.49"
      },
      {
        "status": "affected",
        "version": "KRNL64UC -7.22"
      },
      {
        "status": "affected",
        "version": "KERNEL - 7.22"
      },
      {
        "status": "affected",
        "version": "7.83"
      }
    ]
  }
]

References

packetstormsecurity.com/files/166964/SAP-Web-Dispatcher-HTTP-Request-Smuggling.html

seclists.org/fulldisclosure/2022/May/3

launchpad.support.sap.com/#/notes/3080567

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405

Social References

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

AI Score

Confidence

High

EPSS

0.043

Percentile

92.4%

JSON

Related for CVE-2021-38162