CVE-2022-22536
CriticalActively exploited (CISA KEV)
Description
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.
SeverityCritical
CVSS10.0
Exploit probability—
Product
SAP Multiple Products
PublishedFeb 9, 2022
First seenFeb 9, 2022
Added to KEVAug 18, 2022
Weakness typeCWE-444CWE-444
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: Sep 8, 2022Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sap content_server | 7.53 | — |
| sap netweaver_application_server_abap | 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 8.04, krnl64nuc_7.22, krnl64nuc_7.22ext, krnl64nuc_7.49, krnl64uc_7.22, krnl64uc_7.22ext, krnl64uc_7.49, krnl64uc_7.53, krnl64uc_8.04 | — |
| sap web_dispatcher | 7.22ext, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.