{"schemaVersion":3,"id":"CVE-2022-22536","aliases":[],"status":"published","duplicateOf":null,"title":"SAP Multiple Products HTTP Request Smuggling Vulnerability","description":"SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.","dates":{"published":"2022-02-09T22:05:24.000Z","modified":"2025-10-21T23:15:47.646Z","reserved":null,"kevAdded":["2022-08-18T00:00:00.000Z"],"kevDue":["2022-09-08T00:00:00.000Z"]},"cvss":{"headline":{"score":10,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":10,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":10,"severity":"high","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.97945,"percentile":0.99911,"severity":"critical","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.97945},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.97945,"percentile":0.99911}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.97945,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.97945,"percentile":0.99911}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-08-18T00:00:00.000Z","dueDate":"2022-09-08T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"SAP Multiple Products HTTP Request Smuggling Vulnerability","description":"SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.","notes":[{"type":"text","value":"SAP users must have an account in order to login and access the patch. https://accounts.sap.com/saml2/idp/sso"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2022-22536","label":"nvd.nist.gov/vuln/detail/CVE-2022-22536"}],"vendor":"SAP","product":"Multiple Products","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-08-18T00:00:00.000Z","dueDate":"2022-09-08T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"SAP Multiple Products HTTP Request Smuggling Vulnerability","description":"SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.","notes":[{"type":"text","value":"SAP users must have an account in order to login and access the patch. https://accounts.sap.com/saml2/idp/sso"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2022-22536","label":"nvd.nist.gov/vuln/detail/CVE-2022-22536"}],"vendor":"SAP","product":"Multiple Products","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"52109","name":"SAP NetWeaver - 7.53 - HTTP Request Smuggling","source":"exploit-database","url":"https://www.exploit-db.com/exploits/52109","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"remote","platform":"multiple","file":"exploits/multiple/remote/52109.txt","codes":["CVE-2022-22536"]},"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","description":"The product acts as an intermediary HTTP agent\n         (such as a proxy or firewall) in the data flow between two\n         entities such as a client and server, but it does not\n         interpret malformed HTTP requests or responses in ways that\n         are consistent with how the messages will be processed by\n         those entities that are at the ultimate destination.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/444.html"}],"affected":[{"vendor":"sap_se","product":"sap content server","name":"SAP Content Server","label":"sap content server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"7.53","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.53","eol":null,"hubHref":"/vendor/sap_se/sap_content_server"},{"vendor":"sap_se","product":"sap netweaver and abap platform","name":"SAP NetWeaver and ABAP Platform","label":"sap netweaver and abap platform","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"KERNEL 7.22","noFixRecorded":false,"fixedIn":null},{"text":"8.04","noFixRecorded":false,"fixedIn":null},{"text":"7.49","noFixRecorded":false,"fixedIn":null},{"text":"7.53","noFixRecorded":false,"fixedIn":null},{"text":"7.77","noFixRecorded":false,"fixedIn":null},{"text":"7.81","noFixRecorded":false,"fixedIn":null},{"text":"7.85","noFixRecorded":false,"fixedIn":null},{"text":"7.86","noFixRecorded":false,"fixedIn":null},{"text":"7.87","noFixRecorded":false,"fixedIn":null},{"text":"KRNL64UC 8.04","noFixRecorded":false,"fixedIn":null},{"text":"7.22","noFixRecorded":false,"fixedIn":null},{"text":"7.22EXT","noFixRecorded":false,"fixedIn":null},{"text":"KRNL64NUC 7.22","noFixRecorded":false,"fixedIn":null}],"versionsText":"KERNEL 7.22 | 8.04 | 7.49 | 7.53 | 7.77 | 7.81 | 7.85 | 7.86 | 7.87 | KRNL64UC 8.04 | 7.22 | 7.22EXT | KRNL64NUC 7.22","eol":null,"hubHref":"/vendor/sap_se/sap_netweaver_and_abap_platform"},{"vendor":"sap_se","product":"sap web dispatcher","name":"SAP Web Dispatcher","label":"sap web dispatcher","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"7.49","noFixRecorded":false,"fixedIn":null},{"text":"7.53","noFixRecorded":false,"fixedIn":null},{"text":"7.77","noFixRecorded":false,"fixedIn":null},{"text":"7.81","noFixRecorded":false,"fixedIn":null},{"text":"7.85","noFixRecorded":false,"fixedIn":null},{"text":"7.22EXT","noFixRecorded":false,"fixedIn":null},{"text":"7.86","noFixRecorded":false,"fixedIn":null},{"text":"7.87","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.49 | 7.53 | 7.77 | 7.81 | 7.85 | 7.22EXT | 7.86 | 7.87","eol":null,"hubHref":"/vendor/sap_se/sap_web_dispatcher"},{"vendor":"sap","product":"content_server","name":"content server","label":"content_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"7.53","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.53","eol":null,"hubHref":"/vendor/sap/content_server"},{"vendor":"sap","product":"netweaver_application_server_abap","name":"netweaver application server abap","label":"netweaver_application_server_abap","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"7.22","noFixRecorded":false,"fixedIn":null},{"text":"7.49","noFixRecorded":false,"fixedIn":null},{"text":"753","noFixRecorded":false,"fixedIn":null},{"text":"7.77","noFixRecorded":false,"fixedIn":null},{"text":"7.81","noFixRecorded":false,"fixedIn":null},{"text":"7.85","noFixRecorded":false,"fixedIn":null},{"text":"7.86","noFixRecorded":false,"fixedIn":null},{"text":"787","noFixRecorded":false,"fixedIn":null},{"text":"8.04","noFixRecorded":false,"fixedIn":null},{"text":"krnl64nuc_7.22","noFixRecorded":false,"fixedIn":null},{"text":"krnl64nuc_7.22ext","noFixRecorded":false,"fixedIn":null},{"text":"krnl64nuc_7.49","noFixRecorded":false,"fixedIn":null},{"text":"krnl64uc_7.22","noFixRecorded":false,"fixedIn":null},{"text":"krnl64uc_7.22ext","noFixRecorded":false,"fixedIn":null},{"text":"krnl64uc_7.49","noFixRecorded":false,"fixedIn":null},{"text":"krnl64uc_7.53","noFixRecorded":false,"fixedIn":null},{"text":"krnl64uc_8.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.22 | 7.49 | 753 | 7.77 | 7.81 | 7.85 | 7.86 | 787 | 8.04 | krnl64nuc_7.22 | krnl64nuc_7.22ext | krnl64nuc_7.49 | krnl64uc_7.22 | krnl64uc_7.22ext | krnl64uc_7.49 | krnl64uc_7.53 | krnl64uc_8.04","eol":null,"hubHref":"/vendor/sap/netweaver_application_server_abap"},{"vendor":"sap","product":"web_dispatcher","name":"web dispatcher","label":"web_dispatcher","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"7.22ext","noFixRecorded":false,"fixedIn":null},{"text":"7.49","noFixRecorded":false,"fixedIn":null},{"text":"7.53","noFixRecorded":false,"fixedIn":null},{"text":"7.77","noFixRecorded":false,"fixedIn":null},{"text":"7.81","noFixRecorded":false,"fixedIn":null},{"text":"7.85","noFixRecorded":false,"fixedIn":null},{"text":"7.86","noFixRecorded":false,"fixedIn":null},{"text":"7.87","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.22ext | 7.49 | 7.53 | 7.77 | 7.81 | 7.85 | 7.86 | 7.87","eol":null,"hubHref":"/vendor/sap/web_dispatcher"}],"affectedCount":6,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://launchpad.support.sap.com/#/notes/3123396","label":"launchpad.support.sap.com","hostname":"launchpad.support.sap.com","tags":["X Refsource MISC","Permissions Required"]},{"url":"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html","label":"www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html","hostname":"www.sap.com","tags":["X Refsource MISC","Broken Link","Not Applicable","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22536","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22536","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-02-09T22:05:24.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-08-18T00:00:00.000Z","label":"Added to CISA KEV","detail":"SAP Multiple Products HTTP Request Smuggling Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-09-08T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:15:47.646Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T15:41:51.449Z","stale":false,"partial":false}}