Vulnerability Intelligence Report
CVE-2021-38162
SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.53, KERNEL - 7.22, 7.49, 7.53, 7.77, 7.81, 7.83 processes allow an unauthenticated attacker to submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify any information on the server or consume server resources making it temporarily unavailable.
No Active Exploit Signals
CVSS Base Score
8.9
HIGH
Exploitability:2.3
Impact Score:6.0
EPSS Probability:2.60%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-444 ↗CWE-444
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| SAP SE | SAP Web Dispatcher | WEBDISP - 7.49 (affected), 7.53 (affected), 7.77 (affected), 7.81 (affected), KRNL64NUC - 7.22 (affected), 7.22EXT (affected), 7.49 (affected), KRNL64UC -7.22 (affected), KERNEL - 7.22 (affected), 7.83 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
2.601%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | SAP SE · Vendor · Germany |
| Reserved | 2021-08-07T00:00:00 |
| Published | 2021-09-14T11:15:37 |
| Last Updated | 2024-08-04T01:37:15 |
Community Chatter & Buzz