CVE-2022-22536

Producto

SAP / Multiple Products

Vulnerabilidad

SAP Multiple Products HTTP Request Smuggling Vulnerability

Añadido a KEV

18 ago 2022

Remediar antes de

8 sept 2022

Uso conocido en ransomware

No

Descripción resumida

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.

Acción requerida

Apply updates per vendor instructions.

Notas

SAP users must have an account in order to login and access the patch. https://accounts.sap.com/saml2/idp/sso; https://nvd.nist.gov/vuln/detail/CVE-2022-22536