ACTIEF MISBRUIKT
CVE-2022-22536: SAP Multiple Products HTTP Request Smuggling Vulnerability
| Leverancier | SAP |
|---|---|
| Product | Multiple Products |
| Actief misbruikt | Ja |
| Toegevoegd aan CISA KEV | 18 aug 2022 |
| CISA-deadline (Amerikaanse overheid) | 8 sep 2022 |
| Zwakte (CWE) | CWE-444 |
Vereiste actie (tekst van CISA, Engels)
Apply updates per vendor instructions.
Beschrijving (NVD, Engels)
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.
BRONNEN
Andere lekken bij SAP
- CVE-2025-42999: SAP NetWeaver Deserialization Vulnerability
- CVE-2025-31324: SAP NetWeaver Unrestricted File Upload Vulnerability
- CVE-2017-12637: SAP NetWeaver Directory Traversal Vulnerability
- CVE-2019-0344: SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
- CVE-2021-38163: SAP NetWeaver Unrestricted File Upload Vulnerability
Gegevens van NVD, CISA KEV, FIRST EPSS en adviezen van leveranciers. Bijgewerkt 10 nov 2026.