Severity
7.5HIGH
EPSS
1.1%
top 21.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedApr 12
Latest updateApr 13

Description

By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.85, 7.86, or Internet Communication Manager - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, which makes these programs unavailable, leading to denial of service.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

NVDsap/web_dispatcher5 versions+4
CVEListV5sap_se/sap_web_dispatcher5 versions+4
NVDsap/netweaver10 versions+9

🔴Vulnerability Details

2
GHSA
GHSA-22xf-vh82-92xw: By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 72022-04-13
CVEList
CVE-2022-28772: By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 72022-04-12