VYPR
← All advisories
High severity7.5NVD Advisory· Published Apr 12, 2022· Updated Jun 17, 2026

CVE-2022-28772

CVE-2022-28772

Description

By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.85, 7.86, or Internet Communication Manager - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, which makes these programs unavailable, leading to denial of service.

Affected products

19
  • SAP/Netweaver10 versions
    cpe:2.3:a:sap:netweaver:7.22ext:*:*:*:*:*:*:*+ 9 more
    • cpe:2.3:a:sap:netweaver:7.22ext:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver:7.49:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver:7.53:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver:7.77:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver:7.81:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver:7.85:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver:7.86:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver:kernel_7.22:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver:krnl64nuc_7.22:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver:krnl64uc_7.22:*:*:*:*:*:*:*
  • SAP/Web Dispatcher6 versions
    cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:*+ 5 more
    • cpe:2.3:a:sap:web_dispatcher:7.53:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.77:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.81:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.85:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:web_dispatcher:7.86:*:*:*:*:*:*:*
    • (no CPE)range: 7.53, 7.77, 7.81, 7.85, 7.86
  • SAP/Internet Communication Managerllm-fuzzy
    Range: KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86
  • SAP SE/SAP NetWeaver (Internet Communication Manager)v5
    Range: KRNL64NUC 7.22
  • SAP SE/SAP Web Dispatcherv5
    Range: 7.53

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.