PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-12637 SAP CVE debrief

CISA has added CVE-2017-12637, described as a SAP NetWeaver directory traversal vulnerability, to its Known Exploited Vulnerabilities catalog. For defenders, that means the issue is considered known to be exploited and should be treated as urgent. CISA’s listed guidance is to apply vendor mitigations, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor
SAP
Product
NetWeaver
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2025-03-19
Original CVE updated
2025-03-19
Advisory published
2025-03-19
Advisory updated
2025-03-19

Who should care

SAP NetWeaver administrators, SAP platform owners, vulnerability management teams, and incident responders supporting environments that expose SAP services.

Technical summary

The supplied source identifies CVE-2017-12637 as a directory traversal vulnerability in SAP NetWeaver. Directory traversal flaws can allow access outside intended file or path boundaries when a vulnerable component is reachable. The corpus provided here does not include deeper technical detail, so remediation should be driven by SAP’s official guidance and the CISA KEV entry.

Defensive priority

High. CISA KEV inclusion indicates urgent remediation, with a listed due date of 2025-04-09.

Recommended defensive actions

  • Confirm whether any SAP NetWeaver instances are deployed and whether they are affected.
  • Review SAP’s official guidance and apply the vendor’s mitigations or patches as directed.
  • Ensure your team can access the relevant SAP notes/support materials needed to obtain patch guidance.
  • If mitigations are unavailable, follow CISA guidance to discontinue use of the product until risk is reduced.
  • Track the CISA KEV due date of 2025-04-09 in remediation plans and escalation workflows.

Evidence notes

The supplied authoritative evidence is the CISA KEV entry for CVE-2017-12637, which names the vulnerability 'SAP NetWeaver Directory Traversal Vulnerability,' lists SAP as the vendor/project, marks it as known exploited, and sets dateAdded to 2025-03-19 with dueDate 2025-04-09. The source metadata also notes that SAP users must have an account to log in and access the patch. No additional technical details were provided in the corpus.

Official resources

Public defensive summary based only on the supplied CISA KEV source and official reference links. No exploit instructions or weaponized details are included.