CVE-2021-33683 vulnerability in SAP Products
Published on July 14, 2021
SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, process invalid HTTP header. The incorrect handling of the invalid Transfer-Encoding header in a particular manner leads to a possibility of HTTP Request Smuggling attack. An attacker could exploit this vulnerability to bypass web application firewall protection, divert sensitive data such as customer requests, session credentials, etc.
Weakness Type
What is a HTTP Request Smuggling Vulnerability?
When malformed or abnormal HTTP requests are interpreted by one or more entities in the data flow between the user and the web server, such as a proxy or firewall, they can be interpreted inconsistently, allowing the attacker to "smuggle" a request to one device without the other device being aware of it.
CVE-2021-33683 has been classified to as a HTTP Request Smuggling vulnerability or weakness.
Products Associated with CVE-2021-33683
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2021-33683 are published in these products:
Affected Versions
SAP SE SAP Web Dispatcher and Internet Communication Manager:- Version < KRNL32NUC 7.21 is affected.
- Version < 7.21EXT is affected.
- Version < 7.22 is affected.
- Version < 7.22EXT is affected.
- Version < KRNL32UC 7.21 is affected.
- Version < KRNL64NUC 7.21 is affected.
- Version < 7.49 is affected.
- Version < KRNL64UC 7.21 is affected.
- Version < 7.53 is affected.
- Version < 7.73 is affected.
- Version < WEBDISP 7.53 is affected.
- Version < 7.77 is affected.
- Version < 7.81 is affected.
- Version < 7.82 is affected.
- Version < 7.83 is affected.
- Version < KERNEL 7.21 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.