« Volver al listado

CVE-2023-33987

Estado: ModificadaCrítica (9.4)—

An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90, KERNEL 7.49, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.88, KERNEL 7.89, KERNEL 7.90, KRNL64NUC 7.49, KRNL64UC 7.49, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, can submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages.

Leer descripción completaMostrar menos

This can result in the back-end server executing a malicious payload which can be used to read or modify information on the server or make it temporarily unavailable.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — WEB Dispatcher

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-33987",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-33987",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-04T15:32:02.394644Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.4,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP Web Dispatcher",
          "versions": [
            {
              "status": "affected",
              "version": "WEBDISP 7.49"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.53"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.54"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.77"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.81"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.85"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.88"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.89"
            },
            {
              "status": "affected",
              "version": "WEBDISP 7.90"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.49"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.53"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.54 KERNEL 7.77"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.81"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.85"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.88"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.89"
            },
            {
              "status": "affected",
              "version": "KERNEL 7.90"
            },
            {
              "status": "affected",
              "version": "KRNL64NUC 7.49"
            },
            {
              "status": "affected",
              "version": "KRNL64UC 7.49"
            },
            {
              "status": "affected",
              "version": "KRNL64UC 7.53"
            },
            {
              "status": "affected",
              "version": "HDB 2.00"
            },
            {
              "status": "affected",
              "version": "XS_ADVANCED_RUNTIME 1.00"
            },
            {
              "status": "affected",
              "version": "SAP_EXTENDED_APP_SERVICES 1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-07-11T03:15:09.450",
  "references": [
    {
      "url": "https://me.sap.com/notes/3233899",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://me.sap.com/notes/3233899",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90, KERNEL 7.49, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.88, KERNEL 7.89, KERNEL 7.90, KRNL64NUC 7.49, KRNL64UC 7.49, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, can submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify information on the server or make it temporarily unavailable.\n\n"
    }
  ],
  "lastModified": "2026-06-17T06:02:40.040",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.49:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0B4A7850-377C-4463-A5D7-07F516FBD74A"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47D4D542-2EC2-490B-B4E9-3E7BB8D59B77"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.54:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "950DF1E2-990E-41EF-8779-CEC54C7CDC60"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E33D9481-3CF6-4AA3-B115-7903AC6DAE25"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.81:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49FF2A5B-E5F0-4991-9AA3-7CB3B8C62941"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.85:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F74EE4D5-E968-4851-89E6-4152F64930F2"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.88:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "677B15E6-09B3-4BA8-8D99-427952335035"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.89:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "097ED3E8-49B1-497E-BD43-28C397FBEAE8"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.90:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA093F5F-071D-4FA5-AADA-7E058014AB6E"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:hdb_2.00:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A4A56FB-16CB-4ACA-A961-01F57B1A11F2"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:kernel_7.49:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5512FFE8-E10E-48A3-A153-821D1948AB5E"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:kernel_7.53:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7E4BC89-114A-4EA3-A9E8-D956A26BCB18"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:kernel_7.54:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "65A5FFAC-93F9-4204-9FA1-4D749D443173"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:kernel_7.77:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E0098E57-6A7F-4CC6-8109-E2400E0FFFEB"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:kernel_7.81:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "87738C45-6B88-4DD4-A4A3-4AD47502679C"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:kernel_7.85:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7ABB030-9A13-4194-A2A4-9623B2F22D7D"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:kernel_7.88:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B994804F-5405-4295-93BF-4F1C5C3CF00C"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:kernel_7.89:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB22EAAE-F75C-4902-9734-52B048D5D7B2"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:kernel_7.90:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8D4EFB1-0225-454D-9273-259A4055F482"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:krnl64nuc_7.49:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F634C80-5034-44A2-9F94-69DEDF453998"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.49:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB2FD99C-D945-4495-97C7-03D6C6BBBE4B"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.53:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A8CD933-E217-445A-B244-C07625F9EE74"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:sap_extended_app_services_1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "216C4CEE-E514-43FB-8819-591AF721E2ED"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:xs_advanced_runtime_1.00:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7E9D3697-7C80-4629-AE7A-73BDE5C558B2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}