Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2023-33987Request smuggling and request concatenation in SAP Web Dispatcher

Description

An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90, KERNEL 7.49, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.88, KERNEL 7.89, KERNEL 7.90, KRNL64NUC 7.49, KRNL64UC 7.49, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, can submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify information on the server or make it temporarily unavailable.

Timeline

  1. ID reserved

    By sap

  2. · 48 days later

    Published

  3. · 17 months later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2023-33987, by who scored it
Scored byCVSSScoreVector
sapCNA (assigner)3.1High8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVDNVD · Modified3.1Critical9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
EPSS (exploitation in 30 days)
0.69% · top 47% of all CVEs (14 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: yes · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.6.

Affected products

  • SAP_SE · SAP Web Dispatcher

    • affected WEBDISP 7.49
    • affected WEBDISP 7.53
    • affected WEBDISP 7.54
    • affected WEBDISP 7.77
    • affected WEBDISP 7.81
    • affected WEBDISP 7.85
    • affected WEBDISP 7.88
    • affected WEBDISP 7.89
    • affected WEBDISP 7.90
    • affected KERNEL 7.49
    • affected KERNEL 7.53
    • affected KERNEL 7.54 KERNEL 7.77
    • affected KERNEL 7.81
    • affected KERNEL 7.85
    • affected KERNEL 7.88
    • affected KERNEL 7.89
    • affected KERNEL 7.90
    • affected KRNL64NUC 7.49
    • affected KRNL64UC 7.49
    • affected KRNL64UC 7.53
    • affected HDB 2.00
    • affected XS_ADVANCED_RUNTIME 1.00
    • affected SAP_EXTENDED_APP_SERVICES 1

References

References2

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2023-33987 badge
[![CVE-2023-33987](https://cveledger.app/badge/CVE-2023-33987.svg)](https://cveledger.app/cve/CVE-2023-33987)

Record last updated .