CVE-2022-22536: SAP Multiple Products HTTP Request Smuggling Vulnerability

Published Feb 9, 2022
·
Updated

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.

Other sources

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.

CISA

Affected Software

27 affected components
SAP Multiple Products
SAP Content Server=7.53
SAP NetWeaver Application Server ABAP=7.22
SAP NetWeaver Application Server ABAP=7.49
SAP NetWeaver Application Server ABAP=7.53
SAP NetWeaver Application Server ABAP=7.77
SAP NetWeaver Application Server ABAP=7.81
SAP NetWeaver Application Server ABAP=7.85
SAP NetWeaver Application Server ABAP=7.86
SAP NetWeaver Application Server ABAP=7.87
SAP NetWeaver Application Server ABAP=8.04
SAP NetWeaver Application Server ABAP=krnl64nuc_7.22
SAP NetWeaver Application Server ABAP=krnl64nuc_7.22ext
SAP NetWeaver Application Server ABAP=krnl64nuc_7.49
SAP NetWeaver Application Server ABAP=krnl64uc_7.22
SAP NetWeaver Application Server ABAP=krnl64uc_7.22ext
SAP NetWeaver Application Server ABAP=krnl64uc_7.49
SAP NetWeaver Application Server ABAP=krnl64uc_7.53
SAP NetWeaver Application Server ABAP=krnl64uc_8.04
SAP Web Dispatcher=7.22ext
SAP Web Dispatcher=7.49
SAP Web Dispatcher=7.53
SAP Web Dispatcher=7.77
SAP Web Dispatcher=7.81
SAP Web Dispatcher=7.85
SAP Web Dispatcher=7.86
SAP Web Dispatcher=7.87

Event History

Feb 9, 2022
CVE Published
via MITRE·10:05 PM
Data Sourced
via MITRE·10:05 PM
DescriptionWeakness
Data Sourced
via NVD·11:15 PM
DescriptionSeverityWeaknessAffected Software
Aug 18, 2022
Known Exploited
via CISA·12:00 AM
Apr 2, 2025
Exploit Published
12:00 AM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2022-22536?

CVE-2022-22536 is a vulnerability in SAP Multiple Products that allows an unauthenticated attacker to prepend a victim's request with arbitrary data.

2

Which products are affected by CVE-2022-22536?

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53, and SAP Web Dispatcher are affected by CVE-2022-22536.

3

How severe is CVE-2022-22536?

CVE-2022-22536 has a severity rating of critical.

4

How can an attacker exploit CVE-2022-22536?

An attacker can exploit CVE-2022-22536 by performing request smuggling and request concatenation.

5

Are there any available patches or mitigations for CVE-2022-22536?

Yes, SAP has released patches and mitigations for CVE-2022-22536. Please refer to the official SAP notes and documentation for more information.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203