Active Exploitation of SAP Vulnerability CVE-2017-12637 Putting Things in Perspective

What’s the Risk? 

To be able to better understand what the above means for customers, we would like to list the specific situations in which you are at risk. The risk level varies (for example based on if your SAP systems are internet exposed) but appears limited due to the specific conditions required for vulnerability: 

• Your SAP landscape includes Java systems 

• You installed the SAP job scheduling add-on (Software Component: ETPRJSCHEDULER) 

• You use an outdated version of this add-on (SAP CPS Job Scheduler version 8), which was discontinued in 2020 

Initial analysis suggests that only a small subset of customers meet all these criteria.  

No public data has been shared regarding the frequency, origin, or methods of exploitation, which makes it difficult to assess the threat’s scale. However, since ETPRJSCHEDULER is not part of the default AS Java deployment, and the affected version is long outdated, the overall exploitation risk is considered low. 

That said, if your environment still includes SAP CPS 8.0, swift action is advised—the likelihood may be low, but the potential impact is high. Even though the original SAP Security note 2486657that was released as a first patch, only has a CVSS score of 7.7, a full system compromise is at risk because the vulnerability allows to retrieve sensitive files, like the SAP Secure store files that contain credentials to access the SAP system.