Security readout for executives and security teams
Plain-English summary
This issue can let a remote attacker crash or exhaust memory in the SAP Message Server HTTP daemon. For businesses using affected SAP Kernel versions, the main risk is service disruption, not confirmed data theft or code execution based on the provided sources.
Executive priority
Treat this as a business continuity risk for SAP environments. Prioritize externally reachable or mission-critical SAP systems first, then reduce network exposure and confirm vendor remediation status.
Technical view
CVE-2017-5997 affects the SAP Message Server HTTP daemon in SAP Kernel 7.21 through 7.49. The described condition is a denial of service caused by memory consumption and process crash through repeated crafted group-parameter requests. It is associated with SAP Security Note 2358972.
Likely exposure
Exposure is most likely where SAP Kernel 7.21-7.49 is deployed and the Message Server HTTP daemon is reachable from untrusted networks or broad internal segments.
Exploitation context
The provided bundle does not show CISA KEV listing, public active exploitation, or a CVSS score. The cited description indicates remote denial of service is possible, but does not support broader impact claims.
Researcher notes
The source data is sparse: no CVSS vector, no CWE, and generic affected-product metadata. The strongest technical claim is remote denial of service against SAP Kernel 7.21-7.49 Message Server HTTP daemon, tied to SAP Security Note 2358972.
Mitigation direction
- Review and apply SAP Security Note 2358972 guidance.
- Confirm affected SAP Kernel versions are updated per SAP guidance.
- Restrict Message Server HTTP access to trusted administrative networks.
- Monitor SAP Message Server crashes, memory growth, and abnormal HTTP activity.
- Use compensating network controls if vendor remediation cannot be applied immediately.
Validation and detection
- Inventory SAP systems and record SAP Kernel versions.
- Identify whether the Message Server HTTP daemon is enabled.
- Confirm the daemon is not reachable from untrusted networks.
- Check SAP maintenance records for SAP Security Note 2358972 status.
- Review logs for unexplained Message Server restarts or memory exhaustion.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-5997 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://erpscan.io/advisories/erpscan-16-038-sap-message-server-http-remote-dos/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.