Strix
26.1K

CVE-2021-38162

CRITICALCVSS 9.4/10EPSS 2.60%

Last modified

CVE-2021-38162 is a critical-severity vulnerability rated 9.4/10 on the CVSS scale. SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.53, KERNEL - 7.22, 7.49, 7.53, 7.77, 7.81, 7.83 processes allow an unauthenticated attacker to submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify any information on the server or consume server resources making it temporarily unavailable.. EPSS estimates a 2.60% chance of exploitation in the next 30 days.

Description

SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.53, KERNEL - 7.22, 7.49, 7.53, 7.77, 7.81, 7.83 processes allow an unauthenticated attacker to submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify any information on the server or consume server resources making it temporarily unavailable.

Metrics

CVSS 3.1
9.4/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

EPSS Probability
2.60%

83.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
SapWeb Dispatcher7.22ext
SapWeb Dispatcher7.49
SapWeb Dispatcher7.53
SapWeb Dispatcher7.77
SapWeb Dispatcher7.81
SapWeb Dispatcher7.83
SapWeb Dispatcherkernel_7.22
SapWeb Dispatcherkrnl64nuc_7.22
SapWeb Dispatcherkrnl64uc_7.22

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-38162?
SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.53, KERNEL - 7.22, 7.49, 7.53, 7.77, 7.81, 7.83 processes allow an unauthenticated attacker to submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify any information on the server or consume server resources making it temporarily unavailable.
How severe is CVE-2021-38162?
CVE-2021-38162 has a CVSS score of 9.4/10 (CRITICAL severity). The EPSS model estimates a 2.60% probability of exploitation in the next 30 days.
How do I fix CVE-2021-38162?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-38162?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST