CVE-2017-12637
published 2017-08-07CVE-2017-12637: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers…
PriorityP185high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2025-04-09
Exploited in the wild
EPSS
94.56%
99.8th percentile
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap | netweaver_application_server_java | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url{{BaseURL}}/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/..
- →HTTP GET request to the vulnerable path with a directory traversal payload in the query string (e.g., `?/..`) should be flagged. A successful exploitation returns HTTP 200 with both 'WEB-INF' and 'META-INF' strings in the response body.
- →SAP NetWeaver AS Java instances can be fingerprinted via favicon hash -266008933 on Shodan or FOFA, enabling pre-exploitation reconnaissance targeting.
- →This vulnerability is listed in CISA KEV with a remediation due date of 2025-04-09, indicating active exploitation in the wild. Prioritize detection on internet-facing SAP NetWeaver AS Java instances. ↗
- ·The vulnerability was exploited in the wild as early as August 2017. The CISA KEV entry confirms ongoing exploitation risk, meaning unpatched systems remain actively targeted. ↗
- ·SAP patch access requires an authenticated SAP account. Organizations without portal access may face delays in obtaining the fix. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vulncheck7.5HIGH
cisa7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5p56-56jf-wfv2: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7
ghsa_unreviewed·2022-05-13
CVE-2017-12637 [HIGH] CWE-22 GHSA-5p56-56jf-wfv2: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
VulnCheck
SAP NetWeaver Directory Traversal Vulnerability
vulncheck·2017·CVSS 7.5
CVE-2017-12637 [HIGH] CWE-22 SAP NetWeaver Directory Traversal Vulnerability
SAP NetWeaver Directory Traversal Vulnerability
SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.
Affected: SAP NetWeaver
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://nvd.nist.gov/vuln/detail/CVE-2017-12637; https://www.cve.org/CVERecord?id=CVE-2017-12637; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://app.crowdsec.net/cti/cve-explorer/CVE-2017-12637; https://www.loginsoft.com/reports/annu
CISA
SAP NetWeaver Directory Traversal Vulnerability
cisa·2025-03-19·CVSS 7.5
CVE-2017-12637 [HIGH] CWE-22 SAP NetWeaver Directory Traversal Vulnerability
Vulnerability: SAP NetWeaver Directory Traversal Vulnerability
Affected: SAP NetWeaver
SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: SAP users must have an account to log in and access the patch: https://me.sap.com/notes/3476549 ; https://nvd.nist.gov/vuln/detail/CVE-2017-12637
Remediation Due Date: 2025-04-09
No detection rules found.
Nuclei
SAP NetWaver Security Checks
nuclei·CVSS 7.5
CVE-2020-6287 [HIGH] SAP NetWaver Security Checks
SAP NetWaver Security Checks
A simple workflow that runs all SAP NetWaver related nuclei templates on a given target.
Template:
id: sap-netweaver-workflow
info:
name: SAP NetWaver Security Checks
author: dwisiswant0
description: A simple workflow that runs all SAP NetWaver related nuclei templates on a given target.
workflows:
- template: http/technologies/sap/sap-netweaver-detect.yaml
subtemplates:
- template: http/cves/2020/CVE-2020-6287.yaml
- template: http/cves/2017/CVE-2017-12637.yaml
- template: http/cves/2020/CVE-2020-6308.yaml
- template: http/exposed-panels/fiorilaunchpad-logon.yaml
- template: http/exposed-panels/hmc-hybris-panel.yaml
- template: http/exposed-panels/sap-netweaver-portal.yaml
- template: http/exposed-panels/sap-hana-xsengine-panel.yaml
- template: http
Nuclei
SAP NetWeaver Application Server Java 7.5 - Local File Inclusion
nuclei·CVSS 7.5
CVE-2017-12637 [HIGH] SAP NetWeaver Application Server Java 7.5 - Local File Inclusion
SAP NetWeaver Application Server Java 7.5 - Local File Inclusion
SAP NetWeaver Application Server Java 7.5 is susceptible to local file inclusion in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS. This can allow remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
Template:
id: CVE-2017-12637
info:
name: SAP NetWeaver Application Server Java 7.5 - Local File Inclusion
author: apt-mirror
severity: high
description: SAP NetWeaver Application Server Java 7.5 is susceptible to local file inclusion in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS. This can allow remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017,
2017-08-07
Published
2025-03-19
Added to CISA KEV
Exploited in the wild