CVE-2022-22536— SAP多个产品环境问题漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2022-22536の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
N/A
ソース: NVD (National Vulnerability Database)
脆弱性説明
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.
ソース: NVD (National Vulnerability Database)
CVSS情報
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
HTTP请求的解释不一致性(HTTP请求私运)
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
SAP多个产品环境问题漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
SAP NetWeaver Application Server Java等都是德国思爱普（SAP）公司的产品。SAP NetWeaver Application Server Java是一款提供了Java运行环境的应用程序服务器。SAP NetWeaver Application Server是一款应用程序服务器。SAP ERP是一系列用于ERP管理的软件。SAP CRM是一个客户关系管理系统。Sap Crm Web Channel等都是德国思爱普（Sap）公司的产品。Sap Crm Web Chann
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| SAP SE | SAP NetWeaver and ABAP Platform | KERNEL 7.22 | - | |
| SAP SE | SAP Web Dispatcher | 7.49 | - | |
| SAP SE | SAP Content Server | 7.53 | - |
II. CVE-2022-22536の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|---|---|---|
| 1 | SAP memory pipes(MPI) desynchronization vulnerability CVE-2022-22536. | https://github.com/antx-code/CVE-2022-22536 | POC詳細 |
| 2 | None | https://github.com/tess-ss/SAP-memory-pipes-desynchronization-vulnerability-MPI-CVE-2022-22536 | POC詳細 |
| 3 | SAP memory pipes(MPI) desynchronization vulnerability CVE-2022-22536. | https://github.com/ZZ-SOCMAP/CVE-2022-22536 | POC詳細 |
| 4 | SAPGateBreaker is a PoC exploit for CVE-2022-22536, a critical HTTP Request Smuggling vulnerability in SAP NetWeaver. It demonstrates how to bypass ACLs by desynchronizing request parsing between ICM and backend services using crafted Content-Length-based payloads. | https://github.com/BecodoExploit-mrCAT/SAPGateBreaker-Exploit | POC詳細 |
| 5 | SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable to request smuggling and request concatenation attacks. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22536.yaml | POC詳細 |
| 6 | Fast, socket-level scanner for detecting CVE-2022-22536 in SAP ICM or Web Dispatcher instances. Performs request smuggling tests with a crafted MPI-desync payload. Supports batch scanning IP:PORT targets via plain text files. | https://github.com/abrewer251/CVE-2022-22536_SAP_Request_Smuggling_Scanner | POC詳細 |
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2022-22536のインテリジェンス情報
请登录查看更多情报信息。
- https://launchpad.support.sap.com/#/notes/3123396x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2022-22536
Same Patch Batch · SAP SE · 2022-02-09 · 15 CVEs total
| CVE-2022-22528 | SAP Adaptive Server Enterprise 代码问题漏洞 | |
| CVE-2022-22532 | SAP多个产品环境问题漏洞 | |
| CVE-2022-22533 | SAP NetWeaver Application Server Java 资源管理错误漏洞 | |
| CVE-2022-22534 | SAP Netweaver 跨站脚本漏洞 | |
| CVE-2022-22535 | SAP ERP HCM 安全漏洞 | |
| CVE-2022-22537 | SAP 3D Visual Enterprise Viewer 输入验证错误漏洞 | |
| CVE-2022-22538 | SAP多个产品输入验证错误漏洞 | |
| CVE-2022-22540 | SAP NetWeaver AS SQL注入漏洞 | |
| CVE-2022-22539 | SAP 3D Visual Enterprise Viewer 输入验证错误漏洞 | |
| CVE-2022-22542 | Sap Crm Web Channel 信息泄露漏洞 | |
| CVE-2022-22543 | SAP NetWeaver Application Server 资源管理错误漏洞 | |
| CVE-2022-22545 | SAP NetWeaver Application Server 信息泄露漏洞 | |
| CVE-2022-22546 | SAP Business Objects Web Intelligence 跨站脚本漏洞 | |
| CVE-2022-22544 | SAP Solution Manager 安全漏洞 |
IV. 関連脆弱性
同じベンダー: SAP SE
- CVE-2025-42956
Multiple vulnerabilities in SAP NetWeaver Application Server - CVE-2023-36920
Clickjacking vulnerability in SAP Enable Now - CVE-2023-40307
Privileges Memory Corruption (Out-of-bound write) - CVE-2023-40306
URL Redirection vulnerability in SAP S/4HANA (Manage Catalog - CVE-2022-41208
SAP Financial Consolidation 跨站脚本漏洞
同じ弱点: CWE-444
- CVE-2026-40562
Gazelle versions through 0.49 for Perl allows HTTP Request S - CVE-2026-40561
Starlet versions through 0.31 for Perl allows HTTP Request S - CVE-2026-39805
CL.CL HTTP request smuggling via duplicate Content-Length in - CVE-2026-40560
Starman versions before 0.4018 for Perl allows HTTP Request - CVE-2026-41873
Pony Mail: Admin account takeover via request smuggling
V. CVE-2022-22536へのコメント
まだコメントはありません