CVE-2022-22536
Summary
| CVE | CVE-2022-22536 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-02-09 23:15:00 UTC |
| Updated | 2023-09-27 15:15:00 UTC |
| Description | SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system. |
Risk And Classification
EPSS: 0.938330000 probability, percentile 0.998610000 (date 2026-04-01)
CISA KEV: Listed on 2022-08-18; due 2022-09-08; ransomware use Unknown
Problem Types: CWE-444
CISA Known Exploited Vulnerability
| Vendor | SAP |
|---|---|
| Product | Multiple Products |
| Name | SAP Multiple Products HTTP Request Smuggling Vulnerability |
| Required Action | Apply updates per vendor instructions. |
| Notes | SAP users must have an account in order to login and access the patch. https://accounts.sap.com/saml2/idp/sso; https://nvd.nist.gov/vuln/detail/CVE-2022-22536 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Sap | Content Server | 7.53 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 7.22 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 7.49 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 7.53 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 7.77 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 7.81 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 7.85 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 7.86 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 7.87 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | 8.04 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | krnl64nuc_7.22 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | krnl64nuc_7.22ext | All | All | All |
| Application | Sap | Netweaver Application Server Abap | krnl64nuc_7.49 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | krnl64uc_7.22 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | krnl64uc_7.22ext | All | All | All |
| Application | Sap | Netweaver Application Server Abap | krnl64uc_7.49 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | krnl64uc_7.53 | All | All | All |
| Application | Sap | Netweaver Application Server Abap | krnl64uc_8.04 | All | All | All |
| Application | Sap | Netweaver As Abap | 7.22 | All | All | All |
| Application | Sap | Netweaver As Abap | 7.49 | All | All | All |
| Application | Sap | Netweaver As Abap | 7.53 | All | All | All |
| Application | Sap | Netweaver As Abap | 7.77 | All | All | All |
| Application | Sap | Netweaver As Abap | 7.81 | All | All | All |
| Application | Sap | Netweaver As Abap | 7.85 | All | All | All |
| Application | Sap | Netweaver As Abap | 7.86 | All | All | All |
| Application | Sap | Netweaver As Abap | 7.87 | All | All | All |
| Application | Sap | Netweaver As Abap | 8.04 | All | All | All |
| Application | Sap | Netweaver As Abap | krnl64nuc_7.22 | All | All | All |
| Application | Sap | Netweaver As Abap | krnl64nuc_7.22ext | All | All | All |
| Application | Sap | Netweaver As Abap | krnl64nuc_7.49 | All | All | All |
| Application | Sap | Netweaver As Abap | krnl64uc_7.22 | All | All | All |
| Application | Sap | Netweaver As Abap | krnl64uc_7.22ext | All | All | All |
| Application | Sap | Netweaver As Abap | krnl64uc_7.49 | All | All | All |
| Application | Sap | Netweaver As Abap | krnl64uc_7.53 | All | All | All |
| Application | Sap | Netweaver As Abap | krnl64uc_8.04 | All | All | All |
| Application | Sap | Web Dispatcher | 7.22ext | All | All | All |
| Application | Sap | Web Dispatcher | 7.49 | All | All | All |
| Application | Sap | Web Dispatcher | 7.53 | All | All | All |
| Application | Sap | Web Dispatcher | 7.77 | All | All | All |
| Application | Sap | Web Dispatcher | 7.81 | All | All | All |
| Application | Sap | Web Dispatcher | 7.85 | All | All | All |
| Application | Sap | Web Dispatcher | 7.86 | All | All | All |
| Application | Sap | Web Dispatcher | 7.87 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| launchpad.support.sap.com | MISC | launchpad.support.sap.com | |
| SAP Security Patch Day - February 2022 - Product Security Response at SAP - Community Wiki | MISC | wiki.scn.sap.com | |
| Access Denied | MISC | www.sap.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 150561 SAP NetWeaver Request Smuggling and Request Concatenation Vulnerability
- 376392 SAP NetWeaver Request Smuggling and Request Concatenation Vulnerability
- 87479 SAP Web Dispatcher - Request Smuggling and Request Concatenation Vulnerability
- 87480 SAP Content Server - Request Smuggling and Request Concatenation Vulnerability
- 87481 SAP NetWeaver - Request Smuggling and Request Concatenation Vulnerability