{"id":"CVE-2022-22536","aliases":["EUVD-2022-27682","GHSA-6hc3-539h-6xc6"],"status":"published","title":"SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP...","description":"SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.97945,"percentile":0.99909,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-444"],"published":"2022-02-09T22:05:24Z","modified":"2026-06-17T04:28:33Z","kev":{"date_added":"2022-08-18","due_date":"2022-09-08","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-08-18"},{"source":"kev","since":"2022-08-18"}],"exploits":[{"source":"pocgithub","id":"ZZ-SOCMAP/CVE-2022-22536","title":"ZZ-SOCMAP/CVE-2022-22536","date":"2022-02-15","url":"https://github.com/ZZ-SOCMAP/CVE-2022-22536"},{"source":"pocgithub","id":"tess-ss/SAP-memory-pipes-desynchronization-vulnerability-MPI-CVE-2022-22536","title":"tess-ss/SAP-memory-pipes-desynchronization-vulnerability-MPI-CVE-2022-22536","date":"2022-04-02","url":"https://github.com/tess-ss/SAP-memory-pipes-desynchronization-vulnerability-MPI-CVE-2022-22536"},{"source":"pocgithub","id":"BecodoExploit-mrCAT/SAPGateBreaker-Exploit","title":"BecodoExploit-mrCAT/SAPGateBreaker-Exploit","date":"2025-04-01","url":"https://github.com/BecodoExploit-mrCAT/SAPGateBreaker-Exploit"},{"source":"exploitdb","id":"EDB-52109","title":"SAP NetWeaver - 7.53 - HTTP Request Smuggling","type":"remote","platform":"multiple","date":"2025-04-02","url":"https://www.exploit-db.com/exploits/52109"},{"source":"pocgithub","id":"abrewer251/CVE-2022-22536_SAP_Request_Smuggling_Scanner","title":"abrewer251/CVE-2022-22536_SAP_Request_Smuggling_Scanner","date":"2025-10-31","url":"https://github.com/abrewer251/CVE-2022-22536_SAP_Request_Smuggling_Scanner"},{"source":"nuclei","id":"CVE-2022-22536","title":"SAP Memory Pipes (MPI) Desynchronization","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22536.yaml"}],"products":[{"vendor":"sap","product":"content_server"},{"vendor":"sap","product":"multiple products"},{"vendor":"sap","product":"netweaver_application_server_abap"},{"vendor":"sap","product":"web_dispatcher"},{"vendor":"sap se","product":"sap content server"},{"vendor":"sap se","product":"sap netweaver and abap platform"},{"vendor":"sap se","product":"sap web dispatcher"}],"references":[{"url":"https://launchpad.support.sap.com/#/notes/3123396","tags":["x_refsource_MISC","x_transferred","Permissions Required"]},{"url":"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html","tags":["x_refsource_MISC","x_transferred","Broken Link","Not Applicable","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22536","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22536"},{"url":"https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+February+2022"},{"url":"https://github.com/advisories/GHSA-6hc3-539h-6xc6"}],"sources":{"cve":[{"id":"CVE-2022-22536","description":"SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.","status":"published","published":"2022-02-09T22:05:24Z","modified":"2025-10-21T23:15:47.646Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:34:26.645563Z"}],"euvd":[{"id":"EUVD-2022-27682","description":"SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.","status":"published","published":"2022-02-09T22:05:24Z","modified":"2025-10-21T23:15:47Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-08-18","updated_at":"2026-11-02T20:31:25.901288Z"}],"ghsa":[{"id":"GHSA-6hc3-539h-6xc6","title":"SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP...","description":"SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.","status":"published","published":"2022-02-11T00:00:50Z","modified":"2025-10-22T00:32:29Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:04:05.344883Z"}],"kev":[{"id":"CVE-2022-22536","title":"SAP Multiple Products HTTP Request Smuggling Vulnerability","description":"SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.","cwes":["CWE-444"],"kev":{"date_added":"2022-08-18","due_date":"2022-09-08","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2022-22536","description":"SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.","status":"published","published":"2022-02-09T23:15:18.62Z","modified":"2026-06-17T04:28:33.183Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:07:12.155838Z"}]}}