Actively exploited · Published Feb 9, 2022 · Assigned by sap
CVE-2022-22536
Critical 9.8 Exploited
In plain English
A critical-severity security flaw in SAP Content Server from SAP SE. Attackers are actively exploiting it in the wild (listed by CISA on August 18, 2022). The chance it is exploited in the next 30 days is estimated at 97.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Sep 8, 2022.
Official description
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP NetWeaver and ABAP Platform | KERNEL 7.228.047.497.537.777.817.857.86 |
| SAP SE | SAP Web Dispatcher | 7.497.537.777.817.857.22EXT7.867.87 |
| SAP SE | SAP Content Server | 7.53 |
Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://launchpad.support.sap.com/#/notes/3123396 x_refsource_MISC
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22536 government-resource