CVE-2022-22536

CriticalCVSS 10.0/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-444

Affected software

Vendor	Product	Versions
SAP SE	SAP NetWeaver and ABAP Platform	KERNEL 7.22; 8.04; 7.49; 7.53; 7.77; 7.81; 7.85; 7.86; 7.87; KRNL64UC 8.04; 7.22; 7.22EXT; KRNL64NUC 7.22
SAP SE	SAP Web Dispatcher	7.49; 7.53; 7.77; 7.81; 7.85; 7.22EXT; 7.86; 7.87
SAP SE	SAP Content Server	7.53

References

https://launchpad.support.sap.com/#/notes/3123396Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlBroken Link, Not Applicable, Vendor Advisory
https://launchpad.support.sap.com/#/notes/3123396Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlBroken Link, Not Applicable, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22536US Government Resource

Timeline

Published: Feb 9, 2022
Last modified: Jun 17, 2026
Added to CISA KEV: Aug 18, 2022
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-225376.5When a user opens a manipulated Tagged Image File Format (.tiff, 2d.x3d)) received from untrusted sources in SAP 3D Visual Enterprise Viewer CVE-2022-225386.5When a user opens a manipulated Adobe Illustrator file format (.ai, ai.x3d) received from untrusted sources in SAP 3D Visual Enterprise View CVE-2022-225396.5When a user opens a manipulated JPEG file format (.jpg, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version CVE-2022-22544.8A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 can store a script that could impact other logged in use CVE-2022-225407.5SAP NetWeaver AS ABAP (Workplace Server) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787, allows an attacker to e CVE-2022-225416.5SAP BusinessObjects Business Intelligence Platform - versions 420, 430, may allow legitimate users to access information they shouldn't see CVE-2022-225426.5S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier Role, AND Enterprise S CVE-2022-225437.5SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.CVE-2022-225449.1Solution Manager (Diagnostics Root Cause Analysis Tools) - version 720, allows an administrator to execute code on all connected Diagnostics CVE-2022-225454.9A high privileged user who has access to transaction SM59 can read connection details stored with the destination for http calls in SAP NetW CVE-2022-225465.4Due to improper HTML encoding in input control summary, an authorized attacker can execute XSS vulnerability in SAP Business Objects Web Int CVE-2022-225477.5Simple Diagnostics Agent - versions 1.0 (up to version 1.57.), allows an attacker to access information which would otherwise be restricted