Skip to main content

Web Dispatcher CVE-2023-29108

MEDIUM
Improper Restriction of Communication Channel to Intended Endpoints (CWE-923)
2023-04-11 cna@sap.com
Information Disclosure SAP Web Dispatcher Abap Platform Kernel
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Apr 11, 2023 - 03:15 nvd
MEDIUM 5.3

DescriptionNVD

The IP filter in ABAP Platform and SAP Web Dispatcher - versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89, 7.91, may be vulnerable by erroneous IP netmask handling. This may enable access to backend applications from unwanted sources.

AnalysisAI

The IP filter in ABAP Platform and SAP Web Dispatcher - versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89, 7.91, may be vulnerable by erroneous IP netmask handling. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-923. The IP filter in ABAP Platform and SAP Web Dispatcher - versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89, 7.91, may be vulnerable by erroneous IP netmask handling. This may enable access to backend applications from unwanted sources. Affected products include: Sap Abap Platform Kernel, Sap Web Dispatcher.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Web Dispatcher

View all
CVE-2021-38162 CRITICAL POC
9.4 Sep 14

SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.
CVE-2023-40309 CRITICAL
9.8 Sep 12

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization
CVE-2023-35871 CRITICAL
9.4 Jul 11

The SAP Web Dispatcher - versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP 7.89, WEBDISP 7.91, WE
CVE-2023-33987 CRITICAL
9.4 Jul 11

An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEB
CVE-2023-40308 HIGH
7.5 Sep 12

SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a
CVE-2022-28773 HIGH
7.5 Apr 12

Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash
CVE-2022-28772 HIGH
7.5 Apr 12

By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions

CVE-2024-33005 MEDIUM
6.3 Aug 13

Due to the missing authorization checks in the local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver Appli
CVE-2021-33683 MEDIUM
4.3 Jul 14

SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC

Same weakness CWE-923 – Improper Restriction of Communication Channel to Intended Endpoints

View all
CVE-2026-62836 CRITICAL
10.0
CVE-2026-34205 CRITICAL POC
9.6
CVE-2024-41889 CRITICAL
9.8
CVE-2019-17440 CRITICAL
9.8
CVE-2017-3891 CRITICAL
9.6
CVE-2022-2663 MEDIUM POC
5.3
CVE-2025-20261 HIGH
8.8
CVE-2025-61939 HIGH
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2023-29108 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy