CVE-2022-28772 - By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.85, 7.86, or Internet Communication Manager - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, which makes these programs unavailable, leading to denial of service

Back Back to CVE browser

HIGH

By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.85, 7.86, or Internet Communication Manager - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, which makes these programs unavailable, leading to denial of service

Published Apr 12, 2022

7.5

HIGH

CVSS 3.1

EPSS 1.44%

Description

By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.85, 7.86, or Internet Communication Manager - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, which makes these programs unavailable, leading to denial of service.

Affected products

Vendor SAP SE Product SAP NetWeaver (Internet Communication Manager) Default
n/a
- Version
  7.22EXT
  Status
  affected
  Constraints
  -
- Version
  7.49
  Status
  affected
  Constraints
  -
- Version
  7.53
  Status
  affected
  Constraints
  -
- Version
  7.77
  Status
  affected
  Constraints
  -
- Version
  7.81
  Status
  affected
  Constraints
  -
- Version
  7.85
  Status
  affected
  Constraints
  -
- Version
  7.86
  Status
  affected
  Constraints
  -
- Version
  KERNEL 7.22
  Status
  affected
  Constraints
  -
- Version
  KRNL64NUC 7.22
  Status
  affected
  Constraints
  -
- Version
  KRNL64UC 7.22
  Status
  affected
  Constraints
  -
Vendor SAP SE Product SAP Web Dispatcher Default
n/a
- Version
  7.53
  Status
  affected
  Constraints
  -
- Version
  7.77
  Status
  affected
  Constraints
  -
- Version
  7.81
  Status
  affected
  Constraints
  -
- Version
  7.85
  Status
  affected
  Constraints
  -
- Version
  7.86
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP NetWeaver (Internet Communication Manager)

n/a

Version	Status	Constraints
7.22EXT	affected	-
7.49	affected	-
7.53	affected	-
7.77	affected	-
7.81	affected	-
7.85	affected	-
7.86	affected	-
KERNEL 7.22	affected	-
KRNL64NUC 7.22	affected	-
KRNL64UC 7.22	affected	-

SAP SE

SAP Web Dispatcher

n/a

Version	Status	Constraints
7.53	affected	-
7.77	affected	-
7.81	affected	-
7.85	affected	-
7.86	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-121

CWE-787

Out-of-bounds Write

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-33211
Advisory
https://launchpad.support.sap.com/#/notes/3111311
x_refsource_MISCPermissions RequiredVendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-33211		Advisory
https://launchpad.support.sap.com/#/notes/3111311		x_refsource_MISCPermissions RequiredVendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html		x_refsource_MISCVendor Advisory