CVE-2022-22536: SAP Multiple Products HTTP Request Smuggling Vulnerability

Description

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)97.9% · higher than 100% of CVEs

Exploited in the wildYes

CISA KEVListed Aug 18, 2022

Federal remediation dueSep 8, 2022

Ransomware campaign useNot known

Affected products

Which versions

SC

SAP Content Server · SAP SE

7.53 · source: vendor

SN

SAP NetWeaver and ABAP Platform · SAP SE

KERNEL 7.22; 8.04; 7.49; 7.53; 7.77; 7.81; +7 more · source: vendor

SW

SAP Web Dispatcher · SAP SE

7.49; 7.53; 7.77; 7.81; 7.85; 7.22EXT; +2 more · source: vendor

CS

Content Server · Sap

7.53 · source: NVD

NA

Netweaver Application Server Abap · Sap

7.22; 7.49; 7.53; 7.77; 7.81; 7.85; +11 more · source: NVD

WD

Web Dispatcher · Sap

7.22ext; 7.49; 7.53; 7.77; 7.81; 7.85; +2 more · source: NVD

MP

Multiple Products · SAP

All versions, or not specified · source: KEV