HTTP Request Smuggling Vulnerability in SAP Web Dispatcher and Internet Communication Manager

CVE-2021-33683

Summary

The vulnerability arises from the improper handling of invalid HTTP headers, specifically the Transfer-Encoding field, in the SAP Web Dispatcher and Internet Communication Manager. This flaw can be exploited by an attacker to perform an HTTP request smuggling attack, which allows for the evasion of web application firewall protections. Consequently, sensitive information, including customer requests and session credentials, could be compromised. It is critical for organizations using these products to implement necessary security measures to mitigate this risk.

References