cyfenced.com →

[ CVE-2022-22536 · Published 9 Feb 2022 ]

SAP Multiple Products HTTP Request Smuggling Vulnerability

Exploited · CISA KEV CVSS 10.0 EPSS 98%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-08-18
  • EPSS: 98% chance of exploitation in the next 30 days (higher than 100% of CVEs)
  • Critical severity: CVSS 10.0

[ Description ]Official description

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.

CISA: SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 8 Sep 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References