Paper/Archive/CVE-2022-22532

CVE-2022-22532

SAP SE SAP NetWeaver Application Server Java — In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49…

EPSS 2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 81.3.813 × 2016.3 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an unauthenticated attacker could submit a crafted HTTP server request which triggers improper shared memory buffer handling. This could allow the malicious payload to be executed and hence execute functions that could be impersonating the victim or even steal the victim's logon session.

Affected

ProductAffectedFixed inSource

SAP NetWeaver Application Server JavaKRNL64NUC 7.22–CNA

SAP NetWeaver Application Server Java7.22EXT–CNA

SAP NetWeaver Application Server Java7.49–CNA

SAP NetWeaver Application Server JavaKRNL64UC–CNA

SAP NetWeaver Application Server Java7.22–CNA

SAP NetWeaver Application Server Java7.53–CNA

SAP NetWeaver Application Server JavaKERNEL 7.22–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reflaunchpad.support.sap.com/#/notes/3123427 refsap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html