CVE-2023-33987 Request smuggling and request concatenation in SAP Web Dispatcher
An unauthenticated attacker can exploit request smuggling in SAP Web Dispatcher to read or modify server data or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-33987?
CVE-2023-33987 is a high-severity vulnerability in SAP_SE SAP Web Dispatcher, published on 11 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90, KERNEL 7.49, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.88, KERNEL 7.89, KERNEL 7.90, KRNL64NUC 7.49, KRNL64UC 7.49, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, can submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify information on the server or make it temporarily unavailable.
Weakness: CWE-444
Which versions are affected by CVE-2023-33987?
It affects 1 product.
Products include Sap Web Dispatcher.
How do I fix CVE-2023-33987?
No fix has been published for CVE-2023-33987 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-33987 being exploited?
There is no known exploitation of CVE-2023-33987 in the wild and no public exploit code.
Other vulnerabilities in SAP_SE SAP Web Dispatcher
Sources
Also known as GHSA-hp7v-3j27-4q36.