VYPR
← All advisories
High severity8.6NVD Advisory· Published Jul 11, 2023· Updated Jun 17, 2026

CVE-2023-33987

CVE-2023-33987

Description

An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90, KERNEL 7.49, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.88, KERNEL 7.89, KERNEL 7.90, KRNL64NUC 7.49, KRNL64UC 7.49, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, can submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify information on the server or make it temporarily unavailable.

Affected products

28
  • SAP/Web Dispatcherllm-fuzzy26 versions
    WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90+ 25 more
    • (no CPE)range: WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90
    • (no CPE)range: WEBDISP 7.49
    • cpe:2.3:a:sap:web_dispatcher:7.49:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.54:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.81:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.85:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.88:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.89:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.90:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:hdb_2.00:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:kernel_7.49:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:kernel_7.53:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:kernel_7.54:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:kernel_7.77:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:kernel_7.81:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:kernel_7.85:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:kernel_7.88:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:kernel_7.89:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:kernel_7.90:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:krnl64nuc_7.49:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.49:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.53:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:sap_extended_app_services_1:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:xs_advanced_runtime_1.00:*:*:*:*:*:*:*
  • SAP/Kernelllm-fuzzy
    Range: KERNEL 7.49, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.88, KERNEL 7.89, KERNEL 7.90
  • SAP/SAP Extended App Servicesllm-create
    Range: 1

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.