SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21…
Priority LOW 21CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, process invalid HTTP header. The incorrect handling of the invalid Transfer-Encoding header in a particular manner leads to a possibility of HTTP Request Smuggling attack. An attacker could exploit this vulnerability to bypass web application firewall protection, divert sensitive data such as customer requests, session credentials, etc.
Why it matters now
EPSS 0.00546 45th percentileScored 2026-11-07
Fix Fixed SAP Web Dispatcher and Internet Communication Manager (SAP SE): 7.21EXT, 7.22, 7.22EXT +7
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP Web Dispatcher and Internet Communication Manager | < KRNL32NUC 7.21; before 7.21EXT; before 7.22; before 7.22EXT; < KRNL32UC 7.21; < KRNL64NUC 7.21; before 7.49; < KRNL64UC 7.21; before 7.53; before 7.73; < WEBDISP 7.53; before 7.77; before 7.81; before 7.82; before 7.83; < KERNEL 7.21 | 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83 | Patch available | CNA |
- SAP Web Dispatcher and Internet Communication Manager VendorSAP Affected < KRNL32NUC 7.21; before 7.21EXT; before 7.22; before 7.22EXT; < KRNL32UC 7.21; < KRNL64NUC 7.21; before 7.49; < KRNL64UC 7.21; before 7.53; before 7.73; < WEBDISP 7.53; before 7.77; before 7.81; before 7.82; before 7.83; < KERNEL 7.21 Fixed in 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83 Patch available CNA
CPE configurations NVD · 30
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:web_dispatcher:7.8_kernel_7.21:*:*:*:*:*:*:* | 7.8_kernel_7.21 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.21ext:*:*:*:*:*:*:* | 7.21ext | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.22:*:*:*:*:*:*:* | 7.22 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:* | 7.22ext | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.49:*:*:*:*:*:*:* | 7.49 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:* | 7.53 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.73:*:*:*:*:*:*:* | 7.73 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:* | 7.77 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.81:*:*:*:*:*:*:* | 7.81 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:7.82:*:*:*:*:*:*:* | 7.82 | Vulnerable | SAP |
- cpe:2.3:a:sap:web_dispatcher:7.8_kernel_7.21:*:*:*:*:*:*:* Versions 7.8_kernel_7.21 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.21ext:*:*:*:*:*:*:* Versions 7.21ext Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.22:*:*:*:*:*:*:* Versions 7.22 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:* Versions 7.22ext Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.49:*:*:*:*:*:*:* Versions 7.49 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:* Versions 7.53 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.73:*:*:*:*:*:*:* Versions 7.73 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:* Versions 7.77 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.81:*:*:*:*:*:*:* Versions 7.81 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:7.82:*:*:*:*:*:*:* Versions 7.82 Vulnerable ·SAP
Show 20 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:web_dispatcher:krnl32nuc_7.21:*:*:*:*:*:*:* | krnl32nuc_7.21 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:krnl32uc_7.21:*:*:*:*:*:*:* | krnl32uc_7.21 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:krnl64nuc_7.21:*:*:*:*:*:*:* | krnl64nuc_7.21 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.21:*:*:*:*:*:*:* | krnl64uc_7.21 | Vulnerable | SAP |
| cpe:2.3:a:sap:web_dispatcher:webdisp_7.53:*:*:*:*:*:*:* | webdisp_7.53 | Vulnerable | SAP |
| cpe:2.3:a:sap:internet_communication_manager:7.21ext:*:*:*:*:*:*:* | 7.21ext | Vulnerable | SAP |
| cpe:2.3:a:sap:internet_communication_manager:7.22:*:*:*:*:*:*:* | 7.22 | Vulnerable | SAP |
| cpe:2.3:a:sap:internet_communication_manager:7.22ext:*:*:*:*:*:*:* | 7.22ext | Vulnerable | SAP |
| cpe:2.3:a:sap:internet_communication_manager:7.49:*:*:*:*:*:*:* | 7.49 | Vulnerable | SAP |
| cpe:2.3:a:sap:internet_communication_manager:7.53:*:*:*:*:*:*:* | 7.53 | Vulnerable | SAP |
| cpe:2.3:a:sap:internet_communication_manager:7.73:*:*:*:*:*:*:* | 7.73 | Vulnerable | SAP |
| cpe:2.3:a:sap:internet_communication_manager:7.77:*:*:*:*:*:*:* | 7.77 | Vulnerable | SAP |
| cpe:2.3:a:sap:internet_communication_manager:7.81:*:*:*:*:*:*:* | 7.81 | Vulnerable | SAP |
| cpe:2.3:a:sap:internet_communication_manager:7.82:*:*:*:*:*:*:* | 7.82 | Vulnerable | SAP |
| cpe:2.3:a:sap:internet_communication_manager:kernel_7.21:*:*:*:*:*:*:* | kernel_7.21 | Vulnerable | SAP |
| cpe:2.3:a:sap:internet_communication_manager:krnl32nuc_7.21:*:*:*:*:*:*:* | krnl32nuc_7.21 | Vulnerable | SAP |
| cpe:2.3:a:sap:internet_communication_manager:krnl32uc_7.21:*:*:*:*:*:*:* | krnl32uc_7.21 | Vulnerable | SAP |
| cpe:2.3:a:sap:internet_communication_manager:krnl64nuc_7.21:*:*:*:*:*:*:* | krnl64nuc_7.21 | Vulnerable | SAP |
| cpe:2.3:a:sap:internet_communication_manager:krnl64uc_7.21:*:*:*:*:*:*:* | krnl64uc_7.21 | Vulnerable | SAP |
| cpe:2.3:a:sap:internet_communication_manager:webdisp_7.53:*:*:*:*:*:*:* | webdisp_7.53 | Vulnerable | SAP |
- cpe:2.3:a:sap:web_dispatcher:krnl32nuc_7.21:*:*:*:*:*:*:* Versions krnl32nuc_7.21 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:krnl32uc_7.21:*:*:*:*:*:*:* Versions krnl32uc_7.21 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:krnl64nuc_7.21:*:*:*:*:*:*:* Versions krnl64nuc_7.21 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.21:*:*:*:*:*:*:* Versions krnl64uc_7.21 Vulnerable ·SAP
- cpe:2.3:a:sap:web_dispatcher:webdisp_7.53:*:*:*:*:*:*:* Versions webdisp_7.53 Vulnerable ·SAP
- cpe:2.3:a:sap:internet_communication_manager:7.21ext:*:*:*:*:*:*:* Versions 7.21ext Vulnerable ·SAP
- cpe:2.3:a:sap:internet_communication_manager:7.22:*:*:*:*:*:*:* Versions 7.22 Vulnerable ·SAP
- cpe:2.3:a:sap:internet_communication_manager:7.22ext:*:*:*:*:*:*:* Versions 7.22ext Vulnerable ·SAP
- cpe:2.3:a:sap:internet_communication_manager:7.49:*:*:*:*:*:*:* Versions 7.49 Vulnerable ·SAP
- cpe:2.3:a:sap:internet_communication_manager:7.53:*:*:*:*:*:*:* Versions 7.53 Vulnerable ·SAP
- cpe:2.3:a:sap:internet_communication_manager:7.73:*:*:*:*:*:*:* Versions 7.73 Vulnerable ·SAP
- cpe:2.3:a:sap:internet_communication_manager:7.77:*:*:*:*:*:*:* Versions 7.77 Vulnerable ·SAP
- cpe:2.3:a:sap:internet_communication_manager:7.81:*:*:*:*:*:*:* Versions 7.81 Vulnerable ·SAP
- cpe:2.3:a:sap:internet_communication_manager:7.82:*:*:*:*:*:*:* Versions 7.82 Vulnerable ·SAP
- cpe:2.3:a:sap:internet_communication_manager:kernel_7.21:*:*:*:*:*:*:* Versions kernel_7.21 Vulnerable ·SAP
- cpe:2.3:a:sap:internet_communication_manager:krnl32nuc_7.21:*:*:*:*:*:*:* Versions krnl32nuc_7.21 Vulnerable ·SAP
- cpe:2.3:a:sap:internet_communication_manager:krnl32uc_7.21:*:*:*:*:*:*:* Versions krnl32uc_7.21 Vulnerable ·SAP
- cpe:2.3:a:sap:internet_communication_manager:krnl64nuc_7.21:*:*:*:*:*:*:* Versions krnl64nuc_7.21 Vulnerable ·SAP
- cpe:2.3:a:sap:internet_communication_manager:krnl64uc_7.21:*:*:*:*:*:*:* Versions krnl64uc_7.21 Vulnerable ·SAP
- cpe:2.3:a:sap:internet_communication_manager:webdisp_7.53:*:*:*:*:*:*:* Versions webdisp_7.53 Vulnerable ·SAP
Remediation
- Fix · CNA SAP Web Dispatcher and Internet Communication Manager (SAP SE) Fixed in 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, 7.77, 7.81, 7.82, 7.83
Timeline
- 2026-10-02 Threatist record created from CVE-2021-33683
- 2026-10-03 Alias added: GHSA-wp36-xpj5-g4w9
References
More SAP Internet Communication Manager vulnerabilities
- TI-2007-03506 Internet Communication Manager (aka ICMAN.exe or ICM) in SAP NetWeaver Application Server… CVSS 2.0HIGH 7.8
Sources
- CVE-2021-33683 · CVE Program
- CVE-2021-33683 · NVD
- FIRST EPSS
- GHSA-wp36-xpj5-g4w9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences