cbcvebase.
CVE-2017-9844
published 2017-07-12

CVE-2017-9844: SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in…

PriorityP268high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
5.51%
91.8th percentile
SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804. NOTE: The vendor states that the devserver package of Visual Composer deserializes a malicious object that may cause legitimate users accessing a service, either by crashing or flooding the service.

Affected

1 ranges
VendorProductVersion rangeFixed in
sapnetweaver——

Detection & IOCsextracted from sources · hover to see the quote

  • →Monitor HTTP requests targeting the /developmentserver/metadatauploader endpoint on SAP NetWeaver Visual Composer for unauthenticated file upload attempts, particularly POST requests delivering serialized Java objects. ↗
  • →Detect web shell uploads resulting from exploitation; threat actors abused the metadatauploader endpoint to upload malicious web shells to affected hosts. ↗
  • →Alert on deserialization of untrusted Java objects arriving via the metadatauploader endpoint; the devserver package of Visual Composer is the affected component. ↗
  • ·CVE-2017-9844 specifically affects SAP NetWeaver version 7400.12.21.30308; verify the exact version in scope before applying detection rules. ↗
  • ·The vulnerable component is the Visual Composer devserver package; detections should be scoped to hosts where Visual Composer is installed, as not all SAP NetWeaver deployments include this component. ↗
  • ·Initial investigation of CVE-2025-31324 exploitation was unclear whether it was a new vulnerability or abuse of CVE-2017-9844; both share the same metadatauploader attack surface and should be treated together in detection logic. ↗

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.