Read the docs
TI-2023-17942 Aliases CVE-2023-35871GHSA-mq9c-rx7q-5jph

Memory Corruption vulnerability in SAP Web Dispatcher

Priority MEDIUM 41CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The SAP Web Dispatcher - versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP 7.89, WEBDISP 7.91, WEBDISP 7.92, WEBDISP 7.93, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, has a vulnerability that can be exploited by an unauthenticated attacker to cause memory corruption through logical errors in memory management this may leads to information disclosure or system crashes, which can have low impact on confidentiality and high impact on the integrity and availability of the system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00603 49th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Web DispatcherWEBDISP 7.53; WEBDISP 7.54; WEBDISP 7.77; WEBDISP 7.85; WEBDISP 7.89; WEBDISP 7.91; WEBDISP 7.92; WEBDISP 7.93; KERNEL 7.53; KERNEL 7.54 KERNEL 7.77; KERNEL 7.85; KERNEL 7.89; KERNEL 7.91; KERNEL 7.92; KERNEL 7.93; KRNL64UC 7.53; HDB 2.00; XS_ADVANCED_RUNTIME 1.00; SAP_EXTENDED_APP_SERVICES 1—No fix listedCNA
  • SAP Web Dispatcher VendorSAP Affected WEBDISP 7.53; WEBDISP 7.54; WEBDISP 7.77; WEBDISP 7.85; WEBDISP 7.89; WEBDISP 7.91; WEBDISP 7.92; WEBDISP 7.93; KERNEL 7.53; KERNEL 7.54 KERNEL 7.77; KERNEL 7.85; KERNEL 7.89; KERNEL 7.91; KERNEL 7.92; KERNEL 7.93; KRNL64UC 7.53; HDB 2.00; XS_ADVANCED_RUNTIME 1.00; SAP_EXTENDED_APP_SERVICES 1 Fixed in — No fix listed CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:*7.53VulnerableSAP
cpe:2.3:a:sap:web_dispatcher:7.54:*:*:*:*:*:*:*7.54VulnerableSAP
cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:*7.77VulnerableSAP
cpe:2.3:a:sap:web_dispatcher:7.85:*:*:*:*:*:*:*7.85VulnerableSAP
cpe:2.3:a:sap:web_dispatcher:7.89:*:*:*:*:*:*:*7.89VulnerableSAP
cpe:2.3:a:sap:web_dispatcher:7.91:*:*:*:*:*:*:*7.91VulnerableSAP
cpe:2.3:a:sap:web_dispatcher:7.92:*:*:*:*:*:*:*7.92VulnerableSAP
cpe:2.3:a:sap:web_dispatcher:7.93:*:*:*:*:*:*:*7.93VulnerableSAP
cpe:2.3:a:sap:web_dispatcher:hdb_2.00:*:*:*:*:*:*:*hdb_2.00VulnerableSAP
cpe:2.3:a:sap:web_dispatcher:kernel_7.53:*:*:*:*:*:*:*kernel_7.53VulnerableSAP
  • cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:* Versions 7.53 Vulnerable ·SAP
  • cpe:2.3:a:sap:web_dispatcher:7.54:*:*:*:*:*:*:* Versions 7.54 Vulnerable ·SAP
  • cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:* Versions 7.77 Vulnerable ·SAP
  • cpe:2.3:a:sap:web_dispatcher:7.85:*:*:*:*:*:*:* Versions 7.85 Vulnerable ·SAP
  • cpe:2.3:a:sap:web_dispatcher:7.89:*:*:*:*:*:*:* Versions 7.89 Vulnerable ·SAP
  • cpe:2.3:a:sap:web_dispatcher:7.91:*:*:*:*:*:*:* Versions 7.91 Vulnerable ·SAP
  • cpe:2.3:a:sap:web_dispatcher:7.92:*:*:*:*:*:*:* Versions 7.92 Vulnerable ·SAP
  • cpe:2.3:a:sap:web_dispatcher:7.93:*:*:*:*:*:*:* Versions 7.93 Vulnerable ·SAP
  • cpe:2.3:a:sap:web_dispatcher:hdb_2.00:*:*:*:*:*:*:* Versions hdb_2.00 Vulnerable ·SAP
  • cpe:2.3:a:sap:web_dispatcher:kernel_7.53:*:*:*:*:*:*:* Versions kernel_7.53 Vulnerable ·SAP
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:web_dispatcher:kernel_7.54:*:*:*:*:*:*:*kernel_7.54VulnerableSAP
cpe:2.3:a:sap:web_dispatcher:kernel_7.77:*:*:*:*:*:*:*kernel_7.77VulnerableSAP
cpe:2.3:a:sap:web_dispatcher:kernel_7.85:*:*:*:*:*:*:*kernel_7.85VulnerableSAP
cpe:2.3:a:sap:web_dispatcher:kernel_7.89:*:*:*:*:*:*:*kernel_7.89VulnerableSAP
cpe:2.3:a:sap:web_dispatcher:kernel_7.91:*:*:*:*:*:*:*kernel_7.91VulnerableSAP
cpe:2.3:a:sap:web_dispatcher:kernel_7.92:*:*:*:*:*:*:*kernel_7.92VulnerableSAP
cpe:2.3:a:sap:web_dispatcher:kernel_7.93:*:*:*:*:*:*:*kernel_7.93VulnerableSAP
cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.53:*:*:*:*:*:*:*krnl64uc_7.53VulnerableSAP
cpe:2.3:a:sap:web_dispatcher:sap_extended_app_services_1:*:*:*:*:*:*:*sap_extended_app_services_1VulnerableSAP
cpe:2.3:a:sap:web_dispatcher:xs_advanced_runtime_1.00:*:*:*:*:*:*:*xs_advanced_runtime_1.00VulnerableSAP
  • cpe:2.3:a:sap:web_dispatcher:kernel_7.54:*:*:*:*:*:*:* Versions kernel_7.54 Vulnerable ·SAP
  • cpe:2.3:a:sap:web_dispatcher:kernel_7.77:*:*:*:*:*:*:* Versions kernel_7.77 Vulnerable ·SAP
  • cpe:2.3:a:sap:web_dispatcher:kernel_7.85:*:*:*:*:*:*:* Versions kernel_7.85 Vulnerable ·SAP
  • cpe:2.3:a:sap:web_dispatcher:kernel_7.89:*:*:*:*:*:*:* Versions kernel_7.89 Vulnerable ·SAP
  • cpe:2.3:a:sap:web_dispatcher:kernel_7.91:*:*:*:*:*:*:* Versions kernel_7.91 Vulnerable ·SAP
  • cpe:2.3:a:sap:web_dispatcher:kernel_7.92:*:*:*:*:*:*:* Versions kernel_7.92 Vulnerable ·SAP
  • cpe:2.3:a:sap:web_dispatcher:kernel_7.93:*:*:*:*:*:*:* Versions kernel_7.93 Vulnerable ·SAP
  • cpe:2.3:a:sap:web_dispatcher:krnl64uc_7.53:*:*:*:*:*:*:* Versions krnl64uc_7.53 Vulnerable ·SAP
  • cpe:2.3:a:sap:web_dispatcher:sap_extended_app_services_1:*:*:*:*:*:*:* Versions sap_extended_app_services_1 Vulnerable ·SAP
  • cpe:2.3:a:sap:web_dispatcher:xs_advanced_runtime_1.00:*:*:*:*:*:*:* Versions xs_advanced_runtime_1.00 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-35871
  2. 2026-10-03 Alias added: GHSA-mq9c-rx7q-5jph

References

Advisory 1

Other 1

  • TI-2022-06811 SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP… KEVCVSS 3.1CRITICAL 10.0
  • TI-2023-21149 Missing Authorization check in SAP CommonCryptoLib CVSS 3.1CRITICAL 9.8
  • TI-2023-16854 Request smuggling and request concatenation in SAP Web Dispatcher CVSS 3.1CRITICAL 9.4
  • TI-2021-15841 SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49… CVSS 3.1CRITICAL 9.4
  • TI-2023-21148 Memory Corruption vulnerability in SAP CommonCryptoLib CVSS 3.1HIGH 7.5
  • TI-2022-11400 Uncontrolled recursion in SAP NetWeaver CVSS 3.1HIGH 7.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences