PT-2022-15502 · Sap · Sap Netweaver Application Server Java

Published 2022-02-09 · Updated 2022-09-30 · CVE-2022-22532

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java versions 7.22 through 7.53

Description An unauthenticated attacker could submit a crafted HTTP server request which triggers improper shared memory buffer handling, allowing the malicious payload to be executed. This could enable the attacker to impersonate the victim or steal the victim's logon session.

Recommendations For versions 7.22 through 7.53, update to a version that includes the fix for this issue to prevent improper shared memory buffer handling and potential execution of malicious payloads.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2022-22532

Affected Products

Sap Netweaver Application Server Java

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-22532 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22532 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3123427 · Vendor Advisory
• https://t.me/cibsecurity/37155 · Telegram Post