dbcve.org
Actively exploited in the wild. This CVE is on the CISA Known Exploited Vulnerabilities list — treat remediation as urgent. Federal remediation due by 8 Sep 2022.
Content ServerApplication · Sap

CVE-2022-22536

CRITICAL · 10.0 CVSS v3.1 Published 2022-02-09
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
100/100
Remediation priority · Urgent
In the wild High EPSS Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

This is an HTTP request smuggling vulnerability in SAP NetWeaver Application Server (ABAP and Java), ABAP Platform, SAP Content Server 7.53, and SAP Web Dispatcher. An unauthenticated attacker can prepend arbitrary data to a victim's legitimate request, allowing the attacker to impersonate the victim or poison intermediary web caches. This leads to complete compromise of system confidentiality, integrity, and availability.

MitigationApply SAP Security Note #3122636 and any related patches to all affected SAP NetWeaver components. Review logs for signs of request smuggling attempts and validate that intermediary proxies and web caches are not being poisoned.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Content ServerApplication
Affected:= 7.53
Netweaver Application Server AbapApplication
Affected:= 7.22= 7.49= 7.53= 7.77= 7.81= 7.85= 7.86= 7.87= 8.04= krnl64nuc_7.22= krnl64nuc_7.22ext= krnl64nuc_7.49
Web DispatcherApplication
Affected:= 7.22ext= 7.49= 7.53= 7.77= 7.81= 7.85= 7.86= 7.87

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify SAP NetWeaver Application Server installation
    Check system for SAP NetWeaver ABAP or Java installation. On SAP systems, use transaction SM51 to list installed application server instances, or check for SAP kernel processes running on the system.
    Affected if SAP NetWeaver ABAP or Java is installed and the version matches 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, or 8.04 (or kernel versions krnl64nuc_7.22, krnl64nuc_7.22ext, krnl64nuc_7.49)
  2. Identify SAP Web Dispatcher installation
    Check for SAP Web Dispatcher processes or examine the SAP system profile parameter for icm/HTTP/... entries that indicate Web Dispatcher usage. Look for webdisp* processes or check SAPMMC for Web Dispatcher components.
    Affected if SAP Web Dispatcher is installed and the version matches 7.22ext, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, or 7.87
  3. Identify SAP Content Server installation
    Check for SAP Content Server components using SAP transaction code SLM1 or by examining the content server-related services and processes running on the system.
    Affected if SAP Content Server version 7.53 is installed
  4. Verify HTTP services are exposed
    Determine if the SAP system has HTTP services exposed externally or to untrusted networks. Check ICM (Internet Communication Manager) configuration using transaction SMICM or examine icm/HTTP/... profile parameters.
    Affected if HTTP services are accessible from network segments where untrusted attackers could send requests (the vulnerability requires HTTP request smuggling from an unauthenticated attacker)
  5. Compare installed versions to affected ranges
    Obtain exact version numbers from the installed SAP components using SAP transaction SM51, sapinfo command, or kernel version checks, then compare against the affected version list provided in the CVE.
    Affected if Any installed version exactly matches one of the listed affected versions, indicating the system falls within the vulnerable version range

A system is affected if it runs any SAP NetWeaver Application Server (ABAP/Java), SAP Web Dispatcher, or SAP Content Server version matching the listed affected versions AND has HTTP services exposed to where an unauthenticated attacker could send malicious requests.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply SAP Security Note #3122636 and any related patches to all affected SAP NetWeaver components. Review logs for signs of request smuggling attempts and validate that intermediary proxies and web caches are not being poisoned.

Recommended fix High confidence

Apply SAP Security Note 3123396 - no version upgrade required, this is a patch-based fix for existing supported versions

  1. 1. Identify the exact SAP Support Package Stack (SPS) or Kernel version currently installed on affected systems
  2. 2. Access SAP One Support Launchpad (support.sap.com) and search for Security Note 3123396, which addresses CVE-2022-22536
  3. 3. Review the Security Note to confirm applicability to your specific SAP product version and kernel release
  4. 4. Download the required corrections and patches specified in the Security Note
  5. 5. Implement the corrections following the step-by-step instructions provided in the Security Note
  6. 6. After applying patches, restart affected SAP NetWeaver Application Server and Web Dispatcher components
  7. 7. Verify the fix by testing HTTP request handling and confirming the vulnerability is remediated
  8. 8. For SAP Content Server, ensure the corresponding update for version 7.53 is also applied
Caveat None expected from applying the security patch; standard SAP change management procedures apply

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Content Server Exploited in the wild — priority engagement
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA3.0 h
21.0 hours of engineering $3,680
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,888.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2022-22536 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2022-22536 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data