TI-2021-15841 Aliases CVE-2021-38162 GHSA-r53f-vv7w-9v58

SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49…

MEDIUM 46CWE-444Published 2021-09-14 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · Low
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.53, KERNEL - 7.22, 7.49, 7.53, 7.77, 7.81, 7.83 processes allow an unauthenticated attacker to submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify any information on the server or consume server resources making it temporarily unavailable.

Why it matters now

EPSS 0.02739 86th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP Web Dispatcher	WEBDISP - 7.49; 7.53; 7.77; 7.81; KRNL64NUC - 7.22; 7.22EXT; 7.49; KRNL64UC -7.22; KERNEL - 7.22; 7.83	—	No fix listed	CNA

SAP Web Dispatcher VendorSAP Affected WEBDISP - 7.49; 7.53; 7.77; 7.81; KRNL64NUC - 7.22; 7.22EXT; 7.49; KRNL64UC -7.22; KERNEL - 7.22; 7.83 Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:web_dispatcher:7.22ext:::::::*	7.22ext	Vulnerable	SAP
cpe:2.3:a:sap:web_dispatcher:7.49:::::::*	7.49	Vulnerable	SAP
cpe:2.3:a:sap:web_dispatcher:7.53:::::::*	7.53	Vulnerable	SAP
cpe:2.3:a:sap:web_dispatcher:7.77:::::::*	7.77	Vulnerable	SAP
cpe:2.3:a:sap:web_dispatcher:7.81:::::::*	7.81	Vulnerable	SAP
cpe:2.3:a:sap:web_dispatcher:7.83:::::::*	7.83	Vulnerable	SAP
cpe:2.3:a:sap:web_dispatcher:kernel_7.22:::::::*	kernel_7.22	Vulnerable	SAP
cpe:2.3:a:sap:web_dispatcher:krnl64nuc_7.22:::::::*	krnl64nuc_7.22	Vulnerable	SAP
cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.22:::::::*	krnl64uc_7.22	Vulnerable	SAP

cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:* Versions 7.22ext Vulnerable ·SAP
cpe:2.3:a:sap:web_dispatcher:7.49:*:*:*:*:*:*:* Versions 7.49 Vulnerable ·SAP
cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:* Versions 7.53 Vulnerable ·SAP
cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:* Versions 7.77 Vulnerable ·SAP
cpe:2.3:a:sap:web_dispatcher:7.81:*:*:*:*:*:*:* Versions 7.81 Vulnerable ·SAP
cpe:2.3:a:sap:web_dispatcher:7.83:*:*:*:*:*:*:* Versions 7.83 Vulnerable ·SAP
cpe:2.3:a:sap:web_dispatcher:kernel_7.22:*:*:*:*:*:*:* Versions kernel_7.22 Vulnerable ·SAP
cpe:2.3:a:sap:web_dispatcher:krnl64nuc_7.22:*:*:*:*:*:*:* Versions krnl64nuc_7.22 Vulnerable ·SAP
cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.22:*:*:*:*:*:*:* Versions krnl64uc_7.22 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-38162
2026-10-03 Alias added: GHSA-r53f-vv7w-9v58

References

Exploit 2

Advisory 1

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405

Other 1

https://launchpad.support.sap.com/#/notes/3080567

TI-2022-06811 SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP… KEVCVSS 3.1CRITICAL 10.0
TI-2023-21149 Missing Authorization check in SAP CommonCryptoLib CVSS 3.1CRITICAL 9.8
TI-2023-16854 Request smuggling and request concatenation in SAP Web Dispatcher CVSS 3.1CRITICAL 9.4
TI-2023-17942 Memory Corruption vulnerability in SAP Web Dispatcher CVSS 3.1CRITICAL 9.4
TI-2023-21148 Memory Corruption vulnerability in SAP CommonCryptoLib CVSS 3.1HIGH 7.5
TI-2022-11400 Uncontrolled recursion in SAP NetWeaver CVSS 3.1HIGH 7.5

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences