Lucene search

K
nvd[email protected]NVD:CVE-2021-38162
HistorySep 14, 2021 - 12:15 p.m.

CVE-2021-38162

2021-09-1412:15:10
CWE-444
web.nvd.nist.gov
4
sap
web dispatcher
unauthenticated
remote code execution
vulnerability

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

EPSS

0.043

Percentile

92.4%

SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.53, KERNEL - 7.22, 7.49, 7.53, 7.77, 7.81, 7.83 processes allow an unauthenticated attacker to submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify any information on the server or consume server resources making it temporarily unavailable.

Affected configurations

Nvd
Node
sapweb_dispatcherMatch7.22ext
OR
sapweb_dispatcherMatch7.49
OR
sapweb_dispatcherMatch7.53
OR
sapweb_dispatcherMatch7.77
OR
sapweb_dispatcherMatch7.81
OR
sapweb_dispatcherMatch7.83
OR
sapweb_dispatcherMatchkernel_7.22
OR
sapweb_dispatcherMatchkrnl64nuc_7.22
OR
sapweb_dispatcherMatchkrnl64uc_7.22
VendorProductVersionCPE
sapweb_dispatcher7.22extcpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:*
sapweb_dispatcher7.49cpe:2.3:a:sap:web_dispatcher:7.49:*:*:*:*:*:*:*
sapweb_dispatcher7.53cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:*
sapweb_dispatcher7.77cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:*
sapweb_dispatcher7.81cpe:2.3:a:sap:web_dispatcher:7.81:*:*:*:*:*:*:*
sapweb_dispatcher7.83cpe:2.3:a:sap:web_dispatcher:7.83:*:*:*:*:*:*:*
sapweb_dispatcherkernel_7.22cpe:2.3:a:sap:web_dispatcher:kernel_7.22:*:*:*:*:*:*:*
sapweb_dispatcherkrnl64nuc_7.22cpe:2.3:a:sap:web_dispatcher:krnl64nuc_7.22:*:*:*:*:*:*:*
sapweb_dispatcherkrnl64uc_7.22cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.22:*:*:*:*:*:*:*

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

EPSS

0.043

Percentile

92.4%

Related for NVD:CVE-2021-38162