CVEvulnerability
CVE-2022-22533
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-02-09
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-416
Description
Due to improper error handling in SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an attacker could submit multiple HTTP server requests resulting in errors, such that it consumes the memory buffer. This could result in system shutdown rendering the system unavailable.
Affected configurations
• sap netweaver application server java 7.22
• sap netweaver application server java 7.49
• sap netweaver application server java 7.53
• sap netweaver application server java krnl64nuc 7.22
• sap netweaver application server java krnl64nuc 7.22ext
• sap netweaver application server java krnl64nuc 7.49
• sap netweaver application server java krnl64uc 7.22
• sap netweaver application server java krnl64uc 7.22ext
• sap netweaver application server java krnl64uc 7.49
Related
Weakness · CWE (1)
- CWE-416 Use After Free weakness
References
- https://launchpad.support.sap.com/#/notes/3123427 Permissions Required, Vendor Advisory
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
- https://launchpad.support.sap.com/#/notes/3123427 Permissions Required, Vendor Advisory
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory