CVE-2021-38162 Other in SAP Web Dispatcher
Unauthenticated attackers can send crafted requests to SAP Web Dispatcher to execute malicious payloads, read/modify data, or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-38162?
CVE-2021-38162 is a high-severity vulnerability in SAP Web Dispatcher, published on 14 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.53, KERNEL - 7.22, 7.49, 7.53, 7.77, 7.81, 7.83 processes allow an unauthenticated attacker to submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify any information on the server or consume server resources making it temporarily unavailable.
Weakness: CWE-444
Which versions are affected by CVE-2021-38162?
It affects 1 product.
Products include Sap Web Dispatcher.
How do I fix CVE-2021-38162?
No fix has been published for CVE-2021-38162 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-38162 being exploited?
There is no known exploitation of CVE-2021-38162 in the wild and no public exploit code.
Other vulnerabilities in SAP Web Dispatcher
Sources
Also known as GHSA-r53f-vv7w-9v58.