CVE-2022-22536—SAP Multiple Products HTTP Request Smuggling Vulnerability

PUBLISHEDvulnerability record
2022-08-18 · last modified June 21, 2025

Metadata

CVE ID:
CVE-2022-22536
Project:
SAP
Product:
Multiple Products
Date Added:
2022-08-18
Due Date:
2022-09-08
Last Updated:
June 21, 2025

Vulnerability Name

SAP Multiple Products HTTP Request Smuggling Vulnerability

Description

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.

Known To Be Used in Ransomware Campaigns?

Ransomware Status:
Unknown

Action

Apply updates per vendor instructions.

Additional Notes

  • SAP users must have an account in order to login and access the patch. https://accounts.sap.com/saml2/idp/sso
  • https://nvd.nist.gov/vuln/detail/CVE-2022-22536

Related Weaknesses

browse all CVEs