CVE-2022-22536criticalunder attackCWE-444

CVE-2022-22536: critical vulnerability in SAP Content Server

Published · Updated

Follow this CVE+ Monitor ABAP Platform+ Monitor SAP NetWeaver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 98%
from disclosure to weapon6 days
Published on NVDFeb 9
1st PoC+6d
CISA KEV+190d
Action required by CISAfederal deadline: 2022-09-08

Apply updates per vendor instructions.

In short

SAP NetWeaver and related products allow attackers to inject malicious data into legitimate user requests without authentication. This enables impersonating victims, poisoning web caches, or executing unauthorized functions, potentially compromising the entire system.

Technical detail

HTTP request smuggling vulnerability (CWE-444) affecting SAP NetWeaver ABAP/Java, ABAP Platform, Content Server 7.53, and Web Dispatcher. Unauthenticated attacker can prepend arbitrary data to victim requests via request concatenation, bypassing authentication and authorization controls. Impact includes confidentiality, integrity, and availability compromise through request forgery and cache poisoning.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
SAP SE · SAP Content ServerSAP SE · SAP NetWeaver and ABAP PlatformSAP SE · SAP Web Dispatcher
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SAP Content Server

In the same product, most dangerous first.

CVE-2021-38162HIGHCVE-2021-38162EPSS 2.7%CVE-2022-27668—CVE-2022-27668EPSS 2.2%CVE-2022-28773—CVE-2022-28773EPSS 1.5%CVE-2022-28772—CVE-2022-28772EPSS 1.4%CVE-2022-29616—CVE-2022-29616EPSS 1.0%