ZeroDay Findings
Sign inSign up

Findings

CVE-2017-12637

SAP NetWeaver Directory Traversal Vulnerability

Published Aug 7, 2017 · updated Jun 16, 2026 · sap netweaver application server java

Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 7, 2017 · Catalog

    Detected

    Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.

  2. Mar 19, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Apr 9, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Apr 9, 2025

Affected

  • cpe sap/netweaver application server java7.50
  • vendor SAP NetWeaverversion unspecified

Sources

  • CISA KEVCVE-2017-12637

    SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.

    cisa.gov
  • CVE.orgCVE-2017-12637

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2017-12637

    30-day exploitation probability 95.1%

    first.org
  • NIST NVDCVE-2017-12637

    Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security

    nvd.nist.gov

References