CVE-2022-28773

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can be restarted automatically.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674

Affected software

Vendor	Product	Versions
SAP SE	SAP NetWeaver (Internet Communication Manager)	KRNL64NUC 7.22; 7.22EXT; 7.49; KRNL64UC 7.22; 7.53; KERNEL 7.22; 7.77; 7.81; 7.85; 7.86
SAP SE	SAP Web Dispatcher	7.53; 7.77; 7.81; 7.85; 7.86

References

https://launchpad.support.sap.com/#/notes/3111293Permissions Required, Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
https://launchpad.support.sap.com/#/notes/3111293Permissions Required, Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Timeline

Published: Apr 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-287745.5Under certain conditions, the SAP Host Agent logfile shows information which would otherwise be restricted.CVE-2022-287753.3Improper access control vulnerability in Samsung Flow prior to version 4.8.06.5 allows attacker to write the file without Samsung Flow permi CVE-2022-287767.8Improper access control vulnerability in Galaxy Store prior to version 4.5.36.4 allows attacker to install applications from Galaxy Store wi CVE-2022-287773.3Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without C CVE-2022-287783.3Improper access control vulnerability in Samsung Security Supporter prior to version 1.2.40.0 allows attacker to set the arbitrary folder as CVE-2022-287797.8Uncontrolled search path element vulnerability in Samsung Android USB Driver windows installer program prior to version 1.7.50 allows attack CVE-2022-287805.5Improper access control vulnerability in Weather prior to SMR May-2022 Release 1 allows that attackers can access location information that CVE-2022-287816.7Improper input validation in Settings prior to SMR-May-2022 Release 1 allows attackers to launch arbitrary activity with system privilege. T CVE-2022-287824.6Improper access control vulnerability in Contents To Window prior to SMR May-2022 Release 1 allows physical attacker to install package befo CVE-2022-287837.1Improper validation of removing package name in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to uninstall arbitrary packag CVE-2022-287843.3Path traversal vulnerability in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to list file names in arbitrary directory as CVE-2022-287855.5Improper buffer size check logic in aviextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible tempo