CVE-2022-22540

SAP NetWeaver AS ABAP (Workplace Server) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787, allows an attacker to execute crafted database queries, that could expose the backend database. Successful attacks could result in disclosure of a table of contents from the system, but no risk of modification possible.

• CWE-89

• https://launchpad.support.sap.com/#/notes/3140587Permissions Required, Vendor Advisory
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
• https://launchpad.support.sap.com/#/notes/3140587Permissions Required, Vendor Advisory
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Published

Feb 9, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-22535SAP ERP HCM Portugal - versions 600, 604, 608, does not perf…6.5
• CVE-2022-22536SAP NetWeaver Application Server ABAP, SAP NetWeaver Applica…10
• CVE-2022-22537When a user opens a manipulated Tagged Image File Format (.t…6.5
• CVE-2022-22538When a user opens a manipulated Adobe Illustrator file forma…6.5
• CVE-2022-22539When a user opens a manipulated JPEG file format (.jpg, 2d.x…6.5
• CVE-2022-2254A user with administrative privileges in Distributed Data Sy…4.8
• CVE-2022-22541SAP BusinessObjects Business Intelligence Platform - version…6.5
• CVE-2022-22542S/4HANA Supplier Factsheet exposes the private address and b…6.5
• CVE-2022-22543SAP NetWeaver Application Server for ABAP (Kernel) and ABAP …7.5
• CVE-2022-22544Solution Manager (Diagnostics Root Cause Analysis Tools) - v…9.1
• CVE-2022-22545A high privileged user who has access to transaction SM59 ca…4.9
• CVE-2022-22546Due to improper HTML encoding in input control summary, an a…5.4