SAP Multiple Products HTTP Request Smuggling Vulnerability

A remote attacker, without authentication, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2022-09-08 under CISA BOD 22-01.

This is a Software Vulnerability (CWE-444) (CWE-444) vulnerability in SAP Multiple Products. SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system. Exploitation requires remote network access, low attack complexity, no authentication required, and no user interaction required.

Probably yes if any of these apply:

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2022-08-18 based on evidence of active exploitation in the wild. Federal agencies required to remediate by 2022-09-08.