SAP has released patch to address the ‘request smuggling and request concatenation vulnerability’ in its multiple products. 

Any arbitrary data can be prepended to a victim's request by an unauthenticated attacker. By doing this, the attacker can run scripts pretending to be the victim or compromise intermediary web caches.

 A successful attack could result in a total breach of the system's availability, confidentiality, and integrity.

CISA and other researcher has confirmed exploitation this vulnerability in wild. 

Table 1: Vulnerability details 

                                                                                   Table 2: Vulnerable versions