CVE-2021-38162

Katalog CVE

CVSS 9.4 · Critical EPSS 2,7%

Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada sap web dispatcher. Skor CVSS 3.1 9.4 (Critical) menurut NVD.

Deskripsi (NVD)

SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.53, KERNEL - 7.22, 7.49, 7.53, 7.77, 7.81, 7.83 processes allow an unauthenticated attacker to submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify any information on the server or consume server resources making it temporarily unavailable.

Rincian

Terbit di NVD

14 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.4 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS (30 hari)

2,7% peluang dieksploitasi; lebih tinggi dari 85,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405 advisory vendor
• http://packetstormsecurity.com/files/166964/SAP-Web-Dispatcher-HTTP-Request-Smuggling.html exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2022/May/3 exploit · mailing list · advisory pihak ketiga
• https://launchpad.support.sap.com/#/notes/3080567 permissions required