CVE-2022-22536
SAP Multiple Products HTTP Request Smuggling Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-08-18. Federal due date: 2022-09-08.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SAP NetWeaver - 7.53 - HTTP Request Smuggling2025-04-02 · remote · multiple
Impact
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sap | Content Server | Version 7.53 |
| Sap | Netweaver Application Server Abap | Versions 7.22, 7.49, 7.53, 7.77, 7.81, 7.85 |
| Sap | Web Dispatcher | Versions 7.22ext, 7.49, 7.53, 7.77, 7.81, 7.85 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://launchpad.support.sap.com/#/notes/3123396
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
- https://launchpad.support.sap.com/#/notes/3123396
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22536