CVE-2022-22536: SAP Multiple Products HTTP Request Smuggling Vulnerability
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.
Other sources
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-22536?
CVE-2022-22536 is a vulnerability in SAP Multiple Products that allows an unauthenticated attacker to prepend a victim's request with arbitrary data.
Which products are affected by CVE-2022-22536?
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53, and SAP Web Dispatcher are affected by CVE-2022-22536.
How severe is CVE-2022-22536?
CVE-2022-22536 has a severity rating of critical.
How can an attacker exploit CVE-2022-22536?
An attacker can exploit CVE-2022-22536 by performing request smuggling and request concatenation.
Are there any available patches or mitigations for CVE-2022-22536?
Yes, SAP has released patches and mitigations for CVE-2022-22536. Please refer to the official SAP notes and documentation for more information.