CVE-2022-22536

🗓️ 09 Feb 2022 22:05:24Reported by sapType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 914 Views🌐 WEB

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher request smuggling and concatenation vulnerabilit

Reporter	Title	Published	Views	Family All 37
GithubExploit	Exploit for HTTP Request Smuggling in Sap Content_Server	31 Oct 202519:02	–	githubexploit
GithubExploit	Exploit for HTTP Request Smuggling in Sap Content_Server	15 Feb 202209:22	–	githubexploit
GithubExploit	Exploit for HTTP Request Smuggling in Sap Content_Server	1 Apr 202522:16	–	githubexploit
GithubExploit	Exploit for HTTP Request Smuggling in Sap Content_Server	2 Apr 202216:12	–	githubexploit
GithubExploit	Exploit for HTTP Request Smuggling in Sap Content_Server	15 Feb 202209:22	–	githubexploit
GithubExploit	Exploit for HTTP Request Smuggling in Sap Content_Server	31 Oct 202519:02	–	githubexploit
ICS	2022 Top Routinely Exploited Vulnerabilities	3 Aug 202312:00	–	ics
ATTACKERKB	CVE-2022-22536	9 Feb 202223:15	–	attackerkb
Information Security Automation	August 2023: GitHub PoCs, Vulristics, Qualys First-Party, Tenable ExposureAI, SC Awards and Rapid7, Anglo-Saxon list, MS Patch Tuesday, WinRAR, Juniper	30 Aug 202316:15	–	avleonov
BDU FSTEC	The vulnerabilities of the SAP NetWeaver software integration platform, the SAP Content Server content server, and the SAP Web Dispatcher web dispatcher are related to deficiencies in HTTP request processing. This allows attackers to inject arbitrary code.	1 Mar 202200:00	–	bdu_fstec

NVD

Vulners

Node

sap content_serverMatch7.53

sap netweaver_application_server_abapMatch7.22

sap netweaver_application_server_abapMatch7.49

sap netweaver_application_server_abapMatch7.53

sap netweaver_application_server_abapMatch7.77

sap netweaver_application_server_abapMatch7.81

sap netweaver_application_server_abapMatch7.85

sap netweaver_application_server_abapMatch7.86

sap netweaver_application_server_abapMatch7.87

sap netweaver_application_server_abapMatch8.04

sap netweaver_application_server_abapMatchkrnl64nuc_7.22

sap netweaver_application_server_abapMatchkrnl64nuc_7.22ext

sap netweaver_application_server_abapMatchkrnl64nuc_7.49

sap netweaver_application_server_abapMatchkrnl64uc_7.22

sap netweaver_application_server_abapMatchkrnl64uc_7.22ext

sap netweaver_application_server_abapMatchkrnl64uc_7.49

sap netweaver_application_server_abapMatchkrnl64uc_7.53

sap netweaver_application_server_abapMatchkrnl64uc_8.04

sap web_dispatcherMatch7.22ext

sap web_dispatcherMatch7.49

sap web_dispatcherMatch7.53

sap web_dispatcherMatch7.77

sap web_dispatcherMatch7.81

sap web_dispatcherMatch7.85

sap web_dispatcherMatch7.86

sap web_dispatcherMatch7.87

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP NetWeaver and ABAP Platform",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "KERNEL 7.22"
      },
      {
        "status": "affected",
        "version": "8.04"
      },
      {
        "status": "affected",
        "version": "7.49"
      },
      {
        "status": "affected",
        "version": "7.53"
      },
      {
        "status": "affected",
        "version": "7.77"
      },
      {
        "status": "affected",
        "version": "7.81"
      },
      {
        "status": "affected",
        "version": "7.85"
      },
      {
        "status": "affected",
        "version": "7.86"
      },
      {
        "status": "affected",
        "version": "7.87"
      },
      {
        "status": "affected",
        "version": "KRNL64UC 8.04"
      },
      {
        "status": "affected",
        "version": "7.22"
      },
      {
        "status": "affected",
        "version": "7.22EXT"
      },
      {
        "status": "affected",
        "version": "KRNL64NUC 7.22"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "SAP Web Dispatcher",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "7.49"
      },
      {
        "status": "affected",
        "version": "7.53"
      },
      {
        "status": "affected",
        "version": "7.77"
      },
      {
        "status": "affected",
        "version": "7.81"
      },
      {
        "status": "affected",
        "version": "7.85"
      },
      {
        "status": "affected",
        "version": "7.22EXT"
      },
      {
        "status": "affected",
        "version": "7.86"
      },
      {
        "status": "affected",
        "version": "7.87"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "SAP Content Server",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "7.53"
      }
    ]
  }
]

Source	Link
sap	www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
launchpad	www.launchpad.support.sap.com/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
Content-Length	nested	/sap/admin/public/default.html	HTTP request smuggling via a nested request (Content-Length based) to bypass controls and access internal endpoints.	CWE-444