Description
By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.85, 7.86, or Internet Communication Manager - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, which makes these programs unavailable, leading to denial of service.
Metrics
CVSS 3.1 7.5/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP NetWeaver (Internet Communication Manager) | KRNL64NUC 7.22; 7.22EXT; 7.49; KRNL64UC 7.22; 7.53; KERNEL 7.22; 7.77; 7.81; 7.85; 7.86 |
| SAP SE | SAP Web Dispatcher | 7.53; 7.77; 7.81; 7.85; 7.86 |
References
- https://launchpad.support.sap.com/#/notes/3111311Permissions Required, Vendor Advisory
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
- https://launchpad.support.sap.com/#/notes/3111311Permissions Required, Vendor Advisory
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
Timeline
- Published
- Apr 12, 2022
- Last modified
- Jun 17, 2026
- NVD status
- Modified