CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation Deadline: Sep 8, 2022

High

CISA KEV

CVE-2022-22536

SAP—Multiple Products

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.

Required Action

SAP users must have an account in order to login and access the patch. https://accounts.sap.com/saml2/idp/sso; https://nvd.nist.gov/vuln/detail/CVE-2022-22536

Vulnerability Overview

Severity: High
CISA KEV: Yes
Ransomware: Unknown
Published: Aug 18, 2022
KEV Added: Aug 18, 2022
Due Date: Sep 8, 2022
Related Articles: 0

Vendor

SAP

Multiple Products