Vulnerability · Published Feb 9, 2022 · Assigned by sap

CVE-2022-22532

Critical 9.8

In plain English

A critical-severity security flaw in SAP NetWeaver Application Server Java from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 81% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)2.1%top 18.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an unauthenticated attacker could submit a crafted HTTP server request which triggers improper shared memory buffer handling. This could allow the malicious payload to be executed and hence execute functions that could be impersonating the victim or even steal the victim's logon session.

Affected products (as reported)

Vendor	Product	Versions
SAP SE	SAP NetWeaver Application Server Java	KRNL64NUC 7.227.22EXT7.49KRNL64UC7.227.53KERNEL 7.22

Weakness: CWE-444

References

https://launchpad.support.sap.com/#/notes/3123427 x_refsource_MISC
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html x_refsource_MISC