Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2023-33987

Request smuggling and request concatenation in SAP Web Dispatcher

High8.6EPSS 0.69%
Published
Updated
Reserved
Assigned by
sap

Description

An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90, KERNEL 7.49, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.88, KERNEL 7.89, KERNEL 7.90, KRNL64NUC 7.49, KRNL64UC 7.49, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, can submit a malicious crafted request over a network to a front-end server which may, over several attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages. This can result in the back-end server executing a malicious payload which can be used to read or modify information on the server or make it temporarily unavailable.

Timeline

  1. ID reserved

    By sap

  2. · 48 days later

    Published

  3. · 17 months later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2023-33987, by who scored it
Scored byCVSSScoreVector
sapCNA (assigner)3.1High8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVDNVD · Modified3.1Critical9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
EPSS (exploitation in 30 days)
0.69% · top 47% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: yes · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.6.

Weakness

Affected products

  • SAP_SE · SAP Web Dispatcher

    • affected WEBDISP 7.49
    • affected WEBDISP 7.53
    • affected WEBDISP 7.54
    • affected WEBDISP 7.77
    • affected WEBDISP 7.81
    • affected WEBDISP 7.85
    • affected WEBDISP 7.88
    • affected WEBDISP 7.89
    • affected WEBDISP 7.90
    • affected KERNEL 7.49
    • affected KERNEL 7.53
    • affected KERNEL 7.54 KERNEL 7.77
    • affected KERNEL 7.81
    • affected KERNEL 7.85
    • affected KERNEL 7.88
    • affected KERNEL 7.89
    • affected KERNEL 7.90
    • affected KRNL64NUC 7.49
    • affected KRNL64UC 7.49
    • affected KRNL64UC 7.53
    • affected HDB 2.00
    • affected XS_ADVANCED_RUNTIME 1.00
    • affected SAP_EXTENDED_APP_SERVICES 1

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2023-33987 badge
[![CVE-2023-33987](https://trackcve.app/badge/CVE-2023-33987.svg)](https://trackcve.app/cve/CVE-2023-33987)

Record last updated .