CVE-2022-22536

UNKNOWNKnown Exploited

CISA Known Exploited Vulnerability

SAP users must have an account in order to login and access the patch. https://accounts.sap.com/saml2/idp/sso; https://nvd.nist.gov/vuln/detail/CVE-2022-22536

Remediation deadline: September 8, 2022

Description

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.

Timeline

Published:August 18th, 2022 12:00 AM

Last modified:August 18th, 2022 12:00 AM

Added to KEV:August 18th, 2022

CVSS Scoring

No CVSS v3 score available

Affected Software

From NVD CPE configuration data

Vendors

SAP

Products

Multiple Products

Weaknesses (CWE)

CWE-444

References & Reports

Advisories, patches, and third-party reports

No references available.

Source: CISA KEV + NVD · Data may lag official sources by up to one minute