{"id":"CVE-2022-22536","kind":"vulnerability","aliases":["CVE-2022-22536"],"related":[],"title":"SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53…","description":"SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.","summary":"SAP NetWeaver, ABAP Platform, SAP Content Server and SAP Web Dispatcher can be tricked into HTTP request smuggling. An unauthenticated attacker can prepend arbitrary data to a victim's request, executing functions as the victim or poisoning intermediary web caches.","severity":"critical","cvss":10.0,"epss":0.97945,"exploited":true,"exploited_at":"2022-08-18T00:00:00+00:00","products":[{"name":"SAP Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"sap content server","fixed":[],"affected":"= 7.53","ecosystem":"vendor"},{"name":"sap netweaver application server abap","fixed":[],"affected":"= 7.22","ecosystem":"vendor"},{"name":"sap netweaver application server abap","fixed":[],"affected":"= 7.49","ecosystem":"vendor"},{"name":"sap netweaver application server abap","fixed":[],"affected":"= 7.53","ecosystem":"vendor"},{"name":"sap netweaver application server abap","fixed":[],"affected":"= 7.77","ecosystem":"vendor"},{"name":"sap netweaver application server abap","fixed":[],"affected":"= 7.81","ecosystem":"vendor"},{"name":"sap netweaver application server abap","fixed":[],"affected":"= 7.85","ecosystem":"vendor"},{"name":"sap netweaver application server abap","fixed":[],"affected":"= 7.86","ecosystem":"vendor"},{"name":"sap netweaver application server abap","fixed":[],"affected":"= 7.87","ecosystem":"vendor"},{"name":"sap netweaver application server abap","fixed":[],"affected":"= 8.04","ecosystem":"vendor"},{"name":"sap netweaver application server abap","fixed":[],"affected":"= krnl64nuc_7.22","ecosystem":"vendor"},{"name":"sap netweaver application server abap","fixed":[],"affected":"= krnl64nuc_7.22ext","ecosystem":"vendor"},{"name":"sap netweaver application server abap","fixed":[],"affected":"= krnl64nuc_7.49","ecosystem":"vendor"},{"name":"sap netweaver application server abap","fixed":[],"affected":"= krnl64uc_7.22","ecosystem":"vendor"},{"name":"sap netweaver application server abap","fixed":[],"affected":"= krnl64uc_7.22ext","ecosystem":"vendor"},{"name":"sap netweaver application server abap","fixed":[],"affected":"= krnl64uc_7.49","ecosystem":"vendor"},{"name":"sap netweaver application server abap","fixed":[],"affected":"= krnl64uc_7.53","ecosystem":"vendor"},{"name":"sap netweaver application server abap","fixed":[],"affected":"= krnl64uc_8.04","ecosystem":"vendor"},{"name":"sap web dispatcher","fixed":[],"affected":"= 7.22ext","ecosystem":"vendor"},{"name":"sap web dispatcher","fixed":[],"affected":"= 7.49","ecosystem":"vendor"},{"name":"sap web dispatcher","fixed":[],"affected":"= 7.53","ecosystem":"vendor"},{"name":"sap web dispatcher","fixed":[],"affected":"= 7.77","ecosystem":"vendor"},{"name":"sap web dispatcher","fixed":[],"affected":"= 7.81","ecosystem":"vendor"},{"name":"sap web dispatcher","fixed":[],"affected":"= 7.85","ecosystem":"vendor"},{"name":"sap web dispatcher","fixed":[],"affected":"= 7.86","ecosystem":"vendor"},{"name":"sap web dispatcher","fixed":[],"affected":"= 7.87","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["abap","exploited","netweaver","sap","vendor","web-dispatcher"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the SAP security note and update per vendor instructions; the specific note number and patched versions are not in the sources.","status":"open","published_at":"2022-02-09T23:15:18+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:11:00+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T21:11:00Z","model":"claude-haiku-5-5","output":{"fix":"Apply the SAP security note and update per vendor instructions; the specific note number and patched versions are not in the sources.","reach":"internet","impact":"high","summary":"SAP NetWeaver, ABAP Platform, SAP Content Server and SAP Web Dispatcher can be tricked into HTTP request smuggling. An unauthenticated attacker can prepend arbitrary data to a victim's request, executing functions as the victim or poisoning intermediary web caches.","category":"vendor","who_cares":["sap","netweaver","web-dispatcher","abap"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker impersonates victims and poisons caches, potentially executing functions as users","analyst_note":"Find the SAP Security Note number and affected release list for CVE-2022-22536 on SAP's support portal, and a detection method for affected SAP systems.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00048,"input_tokens":2912,"output_tokens":377,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':18A,21A '-22536':19A,22A '7.53':16A,201C 'abap':5A,11A,33A,38A,43A,48A,53A,58A,63A,68A,73A,78A,83A,88A,93A,98A,103A,108A,113A,138B,148B,190C,196C 'applic':3A,8A,188C,193C 'application':31A,36A,41A,46A,51A,56A,61A,66A,71A,76A,81A,86A,91A,96A,101A,106A,111A 'arbitrari':169B,224C 'attack':166B,216C,229C,243C 'avail':253C 'cach':185B,240C 'complet':247C 'compromis':248C 'concaten':213C 'confidenti':250C 'content':14A,27A,151B,199C 'could':244C 'cve':17A,20A 'data':170B,225C 'dispatch':145B,156B,205C 'dispatcher':116A,119A,122A,125A,128A,131A,134A,137A 'execut':176B,231C 'exploit':139B 'function':177B,232C 'http':161B 'imperson':233C 'integr':251C 'intermediari':183B,238C 'java':10A,195C 'multiple':24A 'netweav':2A,7A,140B,147B,187C,192C 'netweaver':30A,35A,40A,45A,50A,55A,60A,65A,70A,75A,80A,85A,90A,95A,100A,105A,110A 'platform':12A,149B,197C 'poison':182B,237C 'prepend':168B,218C 'products':25A 'request':162B,175B,209C,212C,222C 'result':245C 'sap':1A,6A,13A,23A,26A,29A,34A,39A,44A,49A,54A,59A,64A,69A,74A,79A,84A,89A,94A,99A,104A,109A,114A,117A,120A,123A,126A,129A,132A,135A,141B,146B,150B,154B,186C,191C,198C,203C 'server':4A,9A,15A,28A,32A,37A,42A,47A,52A,57A,62A,67A,72A,77A,82A,87A,92A,97A,102A,107A,112A,152B,189C,194C,200C 'smuggl':163B,210C 'success':242C 'system':256C 'trick':159B 'unauthent':165B,215C 'vendor':142B 'victim':173B,180B,220C,235C 'vulner':207C 'way':227C 'web':115A,118A,121A,124A,127A,130A,133A,136A,144B,155B,184B,204C,239C 'web-dispatch':143B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-02-09T23:15:18+00:00","kev":{"dateAdded":"2022-08-18","dueDate":"2022-09-08","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-22536","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-22536","severity":null,"published_at":"2022-08-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T12:39:23+00:00","note":null},{"source":"epss","external_id":"CVE-2022-22536","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-22536","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-22536","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22536","severity":null,"published_at":"2022-02-09T23:15:18+00:00","modified_at":"2026-06-17T04:28:33+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}