CVE-2017-12637: SAP NetWeaver Directory Traversal Vulnerability
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
Other sources
SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12637?
CVE-2017-12637 is classified as a high severity vulnerability due to its potential to allow remote attackers to read arbitrary files.
How do I fix CVE-2017-12637?
To fix CVE-2017-12637, it is recommended to apply the patches provided in SAP Security Note 2486657.
Which versions of SAP NetWeaver are affected by CVE-2017-12637?
CVE-2017-12637 affects SAP NetWeaver Application Server Java version 7.50.
What type of vulnerability is CVE-2017-12637?
CVE-2017-12637 is classified as a directory traversal vulnerability.
Can CVE-2017-12637 be exploited remotely?
Yes, CVE-2017-12637 can be exploited remotely through specially crafted query strings.