CVE-2022-22536: SAP Multiple Products HTTP Request Smuggling Vulnerability
In CISA’s Known Exploited Vulnerabilities catalog: SAP Multiple Products HTTP Request Smuggling Vulnerability.
Added , federal remediation due . Known ransomware use: Unknown.
Required action: Apply updates per vendor instructions.
Description
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · CWE-444
Status incidents that name it
No tracked status incident names this CVE.
Affected vendors and products
SAP SE: SAP Content ServerSAP SE: SAP NetWeaver and ABAP PlatformSAP SE: SAP Web Dispatcher
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- launchpad.support.sap.com (opens in new tab)
- www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)