VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Jul 14, 2021· Updated Jun 17, 2026

CVE-2021-33683

CVE-2021-33683

Description

SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, process invalid HTTP header. The incorrect handling of the invalid Transfer-Encoding header in a particular manner leads to a possibility of HTTP Request Smuggling attack. An attacker could exploit this vulnerability to bypass web application firewall protection, divert sensitive data such as customer requests, session credentials, etc.

Affected products

34
  • SAP SE/SAP Web Dispatcher and Internet Communication Managerv5
    Range: < KRNL32NUC 7.21
  • SAP/Internet Communication Managerllm-fuzzy16 versions
    (expand)+ 15 more
    • (no CPE)
    • cpe:2.3:a:sap:internet_communication_manager:7.21ext:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:internet_communication_manager:7.22:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:internet_communication_manager:7.22ext:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:internet_communication_manager:7.49:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:internet_communication_manager:7.53:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:internet_communication_manager:7.73:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:internet_communication_manager:7.77:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:internet_communication_manager:7.81:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:internet_communication_manager:7.82:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:internet_communication_manager:kernel_7.21:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:internet_communication_manager:krnl32nuc_7.21:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:internet_communication_manager:krnl32uc_7.21:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:internet_communication_manager:krnl64nuc_7.21:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:internet_communication_manager:krnl64uc_7.21:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:internet_communication_manager:webdisp_7.53:*:*:*:*:*:*:*
  • SAP/Kernelllm-fuzzy
  • SAP/Web Dispatcherllm-fuzzy16 versions
    (expand)+ 15 more
    • (no CPE)
    • cpe:2.3:a:sap:web_dispatcher:7.8_kernel_7.21:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.21ext:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.22:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.49:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.73:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.81:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.82:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:krnl32nuc_7.21:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:krnl32uc_7.21:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:krnl64nuc_7.21:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.21:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:webdisp_7.53:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.