CVE-2022-22536

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-22536
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.

10.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

10.0 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://launchpad.support.sap.com/#/notes/3123396 Permissions Required Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:content_server:7.53:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:7.49:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:7.53:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:7.77:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:7.81:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:7.85:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:7.86:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:7.87:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:8.04:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:krnl64nuc_7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:krnl64nuc_7.22ext:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:krnl64nuc_7.49:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.22ext:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.49:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.53:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_8.04:*:*:*:*:*:*:*
cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:*
cpe:2.3:a:sap:web_dispatcher:7.49:*:*:*:*:*:*:*
cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:*
cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:*
cpe:2.3:a:sap:web_dispatcher:7.81:*:*:*:*:*:*:*
cpe:2.3:a:sap:web_dispatcher:7.85:*:*:*:*:*:*:*
cpe:2.3:a:sap:web_dispatcher:7.86:*:*:*:*:*:*:*
cpe:2.3:a:sap:web_dispatcher:7.87:*:*:*:*:*:*:*
History

27 Sep 2023, 15:15

Type Values Removed Values Added
Summary SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system. SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.

09 Jan 2023, 20:29

Type Values Removed Values Added
First Time Sap netweaver Application Server Abap
CPE cpe:2.3:a:sap:netweaver_as_abap:7.53:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:7.86:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_7.49:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_7.49:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_7.22ext:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:7.85:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:8.04:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:7.87:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_8.04:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:7.81:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:7.77:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_7.22ext:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_7.53:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:7.49:*:*:*:*:*:*:*		 cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.49:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.53:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:7.53:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:krnl64nuc_7.49:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:7.49:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:7.87:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:7.86:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:krnl64nuc_7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:7.77:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:krnl64nuc_7.22ext:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:7.85:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_8.04:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:7.81:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:8.04:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.22ext:*:*:*:*:*:*:*

27 Oct 2022, 01:11

Type Values Removed Values Added
References (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory

24 Aug 2022, 16:15

Type Values Removed Values Added
References
  • {'url': 'https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+February+2022', 'name': 'https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+February+2022', 'tags': ['Vendor Advisory'], 'refsource': 'MISC'}
  • (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html -

11 Feb 2022, 15:05

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : 10.0
v3 : 10.0
References (MISC) https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+February+2022 - (MISC) https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+February+2022 - Vendor Advisory
References (MISC) https://launchpad.support.sap.com/#/notes/3123396 - (MISC) https://launchpad.support.sap.com/#/notes/3123396 - Permissions Required, Vendor Advisory
First Time Sap
Sap netweaver As Abap
Sap content Server
Sap web Dispatcher
CPE cpe:2.3:a:sap:netweaver_as_abap:8.04:*:*:*:*:*:*:*
cpe:2.3:a:sap:web_dispatcher:7.49:*:*:*:*:*:*:*
cpe:2.3:a:sap:content_server:7.53:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:7.87:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:7.81:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_7.49:*:*:*:*:*:*:*
cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:*
cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_7.49:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:7.86:*:*:*:*:*:*:*
cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_7.22ext:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:7.49:*:*:*:*:*:*:*
cpe:2.3:a:sap:web_dispatcher:7.87:*:*:*:*:*:*:*
cpe:2.3:a:sap:web_dispatcher:7.86:*:*:*:*:*:*:*
cpe:2.3:a:sap:web_dispatcher:7.81:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_7.22ext:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_8.04:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:7.85:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_7.53:*:*:*:*:*:*:*
cpe:2.3:a:sap:web_dispatcher:7.85:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:7.77:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:7.53:*:*:*:*:*:*:*

09 Feb 2022, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-02-09 23:15

Updated : 2023-12-10 14:22

NVD link : CVE-2022-22536

Mitre link : CVE-2022-22536

CVE.ORG link : CVE-2022-22536

JSON object : View

Products Affected

sap

  • content_server
  • web_dispatcher
  • netweaver_application_server_abap
CWE
CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')