CVE-2022-22536

Estado: AnalizadaCrítica (10)⚠ Explotación activa

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Puntuación base: 10

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 98%
Percentil entre todas las CVEs puntuadas: 100
Fecha de la puntuación: 29/9/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

Añadida al catálogo: 18/8/2022
Plazo de remediación: 8/9/2022
Uso conocido en ransomware: Unknown

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access95 %
Impacto principalT1078 Valid Accountsstealth · persistence · privilege escalation · initial access85 %
Impacto secundarioT1499.004 Application or System Exploitationimpact75 %
Impacto secundarioT1565.001 Stored Data Manipulationimpact80 %

Vulnerabilidad de request smuggling en servicios web SAP accesibles remotamente sin autenticación (AV:N/PR:N). El atacante suplanta víctimas (T1078), manipula datos en caché (T1565.001) y causa negación de servicio (T1499.004). Impacto confirmado: C:H/I:H/A:H.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Filter Network Traffic Application Developer Guidance Active Directory Configuration Vulnerability Scanning User Training

Tecnologías afectadas (3)

SAP — Content Server SAP — Netweaver Application Server Abap SAP — WEB Dispatcher

CWE

CWE-444
CWE-444

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2022-22536",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-22536",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-29T20:20:36.420396Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP NetWeaver and ABAP Platform",
          "versions": [
            {
              "status": "affected",
              "version": "KERNEL 7.22"
            },
            {
              "status": "affected",
              "version": "8.04"
            },
            {
              "status": "affected",
              "version": "7.49"
            },
            {
              "status": "affected",
              "version": "7.53"
            },
            {
              "status": "affected",
              "version": "7.77"
            },
            {
              "status": "affected",
              "version": "7.81"
            },
            {
              "status": "affected",
              "version": "7.85"
            },
            {
              "status": "affected",
              "version": "7.86"
            },
            {
              "status": "affected",
              "version": "7.87"
            },
            {
              "status": "affected",
              "version": "KRNL64UC 8.04"
            },
            {
              "status": "affected",
              "version": "7.22"
            },
            {
              "status": "affected",
              "version": "7.22EXT"
            },
            {
              "status": "affected",
              "version": "KRNL64NUC 7.22"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "SAP SE",
          "product": "SAP Web Dispatcher",
          "versions": [
            {
              "status": "affected",
              "version": "7.49"
            },
            {
              "status": "affected",
              "version": "7.53"
            },
            {
              "status": "affected",
              "version": "7.77"
            },
            {
              "status": "affected",
              "version": "7.81"
            },
            {
              "status": "affected",
              "version": "7.85"
            },
            {
              "status": "affected",
              "version": "7.22EXT"
            },
            {
              "status": "affected",
              "version": "7.86"
            },
            {
              "status": "affected",
              "version": "7.87"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "SAP SE",
          "product": "SAP Content Server",
          "versions": [
            {
              "status": "affected",
              "version": "7.53"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2022-02-09T23:15:18.620",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/3123396",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Broken Link",
        "Not Applicable",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/3123396",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Broken Link",
        "Not Applicable",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22536",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system."
    },
    {
      "lang": "es",
      "value": "SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 y SAP Web Dispatcher son vulnerables para el contrabando de peticiones y la concatenación de peticiones. Un atacante no autenticado puede añadir datos arbitrarios a la petición de la víctima. De este modo, el atacante puede ejecutar funciones suplantando a la víctima o envenenar las cachés web intermediarias. Un ataque con éxito podría resultar en el compromiso completo de la Confidencialidad, Integridad y Disponibilidad del sistema"
    }
  ],
  "lastModified": "2026-06-17T04:28:33.183",
  "cisaActionDue": "2022-09-08",
  "cisaExploitAdd": "2022-08-18",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:content_server:7.53:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A02FB973-7FA0-4881-B912-27F4CFBDC673"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.22:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16B3C589-DF11-459D-8A3F-1A1FD2265022"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.49:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FBC5614-7C3F-4AD8-8640-0499B8B03C64"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.53:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E8CB869-C342-4362-9A4A-298F0B5F4003"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.77:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89E7439E-F4D6-45EA-99FC-C9B34D4D590E"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.81:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "252DCEF2-8DDF-467F-8869-B69A0A3426F8"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.85:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9BC578BE-2308-491E-9D56-6B45AFF0FCFA"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.86:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C0E10A3-591A-4FA7-9B98-D54C3D6C63FA"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:7.87:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "150B6370-F18A-4657-95ED-D969BF7C39CE"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:8.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12974FFA-3168-4A80-ACFB-D5E065A89383"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:krnl64nuc_7.22:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2D5BECF-C4BA-44C7-9AD7-56865DD9AD60"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:krnl64nuc_7.22ext:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB7E91DE-A52F-4E57-8397-7670E30C8B5C"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:krnl64nuc_7.49:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB478A3C-4DD5-4F42-B2F1-9B7CCBA1B995"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.22:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23257C18-B75C-471C-9EAF-1E86DEE845FA"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.22ext:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A01290A1-3C1B-4AF7-9284-C164BDEC85A2"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.49:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D5F8B53-ECAD-4CD2-8F91-25112569C056"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_7.53:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ADE160BD-659F-4517-B625-61CFB2FBD456"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:krnl64uc_8.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "88CD861F-08FB-4CE1-923C-79D1480A2259"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.22ext:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3F76E6A-2F27-450C-AAB5-E49A64079CAC"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.49:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0B4A7850-377C-4463-A5D7-07F516FBD74A"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47D4D542-2EC2-490B-B4E9-3E7BB8D59B77"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E33D9481-3CF6-4AA3-B115-7903AC6DAE25"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.81:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49FF2A5B-E5F0-4991-9AA3-7CB3B8C62941"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.85:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F74EE4D5-E968-4851-89E6-4152F64930F2"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.86:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "327A87AD-6635-4511-8505-F4418CD9D49C"
            },
            {
              "criteria": "cpe:2.3:a:sap:web_dispatcher:7.87:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "324C32FF-6F89-401F-9ADD-57A68320E06D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "SAP Multiple Products HTTP Request Smuggling Vulnerability"
}