PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-12637 SAP CVE debrief

CISA has added CVE-2017-12637, described as a SAP NetWeaver directory traversal vulnerability, to its Known Exploited Vulnerabilities catalog. For defenders, that means the issue is considered known to be exploited and should be treated as urgent. CISA’s listed guidance is to apply vendor mitigations, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor
SAP
Product
NetWeaver
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2025-03-19
Original CVE updated
2025-03-19
Advisory published
2025-03-19
Advisory updated
2025-03-19

Who should care

SAP NetWeaver administrators, SAP platform owners, vulnerability management teams, and incident responders supporting environments that expose SAP services.

Technical summary

The supplied source identifies CVE-2017-12637 as a directory traversal vulnerability in SAP NetWeaver. Directory traversal flaws can allow access outside intended file or path boundaries when a vulnerable component is reachable. The corpus provided here does not include deeper technical detail, so remediation should be driven by SAP’s official guidance and the CISA KEV entry.

Defensive priority

High. CISA KEV inclusion indicates urgent remediation, with a listed due date of 2025-04-09.

Recommended defensive actions

  • Confirm whether any SAP NetWeaver instances are deployed and whether they are affected.
  • Review SAP’s official guidance and apply the vendor’s mitigations or patches as directed.
  • Ensure your team can access the relevant SAP notes/support materials needed to obtain patch guidance.
  • If mitigations are unavailable, follow CISA guidance to discontinue use of the product until risk is reduced.
  • Track the CISA KEV due date of 2025-04-09 in remediation plans and escalation workflows.

Evidence notes

The supplied authoritative evidence is the CISA KEV entry for CVE-2017-12637, which names the vulnerability 'SAP NetWeaver Directory Traversal Vulnerability,' lists SAP as the vendor/project, marks it as known exploited, and sets dateAdded to 2025-03-19 with dueDate 2025-04-09. The source metadata also notes that SAP users must have an account to log in and access the patch. No additional technical details were provided in the corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-12637 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-12637

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-12637 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-12637

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.