SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
sap content server 7.53 |
||
sap netweaver as abap 7.22 |
||
sap netweaver as abap 7.49 |
||
sap netweaver as abap 7.53 |
||
sap netweaver as abap 7.77 |
||
sap netweaver as abap 7.81 |
||
sap netweaver as abap 7.85 |
||
sap netweaver as abap 7.86 |
||
sap netweaver as abap 7.87 |
||
sap netweaver as abap 8.04 |
||
sap netweaver as abap krnl64nuc_7.22 |
||
sap netweaver as abap krnl64nuc_7.22ext |
||
sap netweaver as abap krnl64nuc_7.49 |
||
sap netweaver as abap krnl64uc_7.22 |
||
sap netweaver as abap krnl64uc_7.22ext |
||
sap netweaver as abap krnl64uc_7.49 |
||
sap netweaver as abap krnl64uc_7.53 |
||
sap netweaver as abap krnl64uc_8.04 |
||
sap web dispatcher 7.22ext |
||
sap web dispatcher 7.49 |
||
sap web dispatcher 7.53 |
||
sap web dispatcher 7.77 |
||
sap web dispatcher 7.81 |
||
sap web dispatcher 7.85 |
||
sap web dispatcher 7.86 |
||
sap web dispatcher 7.87 |
There’s a trio of critical vulnerabilities, fixed on Tuesday, in SAP business applications that use the ubiquitous Internet Communication Manager (ICM): the component that gives SAP products the HTTPS web server they need to connect to the internet or talk to each other.
The vulnerabilities, discovered by Onapsis Research Labs, are tracked as CVE-2022-22536, CVE-2022-22532 and CVE-2022-22533. The first CVE, addressed in Security Note 3123396, received the tip-top risk score – a 10 out ...
The US Cybersecurity and Infrastructure Security Agency (CISA) has
to patch a set of severe security flaws dubbed ICMAD (Internet Communication Manager Advanced Desync) and impacting SAP business apps using Internet Communication Manager (ICM).
CISA added that failing to patch these vulnerabilities exposes organizations with vulnerable servers to data theft, financial fraud risks, disruptions of mission-critical business processes, ransomware attacks, and a halt of all operations.<...
Get our weekly newsletter Excitement this month can be found in SAP code, with critical Log4j repairs and a CISA warning
Patch Tuesday Microsoft for its February Patch Tuesday gave Windows admins just 51 fixes to apply, the smallest number of patches since the meager ration of 44 in August 2021.
February tends to be a slow month for repairs because bugs left untended over the winter holidays often get dealt with in January, leaving not all that much for the following month.
Perhaps more noteworthy is that there's not a single critical CVE listed in the February patch list. Fifty of the fixes are rated ...
Vulmon