Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-22536

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.

Published

2022-02-09T23:15:18.620

Last Modified

2025-03-13T16:36:39.573

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 10.0 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-444
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application sap content_server 7.53 Yes
Application sap netweaver_application_server_abap 7.22 Yes
Application sap netweaver_application_server_abap 7.49 Yes
Application sap netweaver_application_server_abap 7.53 Yes
Application sap netweaver_application_server_abap 7.77 Yes
Application sap netweaver_application_server_abap 7.81 Yes
Application sap netweaver_application_server_abap 7.85 Yes
Application sap netweaver_application_server_abap 7.86 Yes
Application sap netweaver_application_server_abap 7.87 Yes
Application sap netweaver_application_server_abap 8.04 Yes
Application sap netweaver_application_server_abap krnl64nuc_7.22 Yes
Application sap netweaver_application_server_abap krnl64nuc_7.22ext Yes
Application sap netweaver_application_server_abap krnl64nuc_7.49 Yes
Application sap netweaver_application_server_abap krnl64uc_7.22 Yes
Application sap netweaver_application_server_abap krnl64uc_7.22ext Yes
Application sap netweaver_application_server_abap krnl64uc_7.49 Yes
Application sap netweaver_application_server_abap krnl64uc_7.53 Yes
Application sap netweaver_application_server_abap krnl64uc_8.04 Yes
Application sap web_dispatcher 7.22ext Yes
Application sap web_dispatcher 7.49 Yes
Application sap web_dispatcher 7.53 Yes
Application sap web_dispatcher 7.77 Yes
Application sap web_dispatcher 7.81 Yes
Application sap web_dispatcher 7.85 Yes
Application sap web_dispatcher 7.86 Yes
Application sap web_dispatcher 7.87 Yes
References