{"id":"CVE-2017-12637","published":"2017-08-07T20:29:01Z","modified":"2026-06-17T01:03:42Z","title":"SAP NetWeaver Directory Traversal Vulnerability","vendor":"SAP","product":"NetWeaver","tier":"core","eol":null,"description":{"text":"Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.","provenance":"source","from":"NVD"},"summary":{"text":"A directory traversal flaw in the UIUtilJavaScriptJS component (under scheduler/ui/js) of SAP NetWeaver Application Server Java 7.5 lets the application resolve paths outside their intended directory. An attacker with network access can exploit it remotely without authentication or user interaction, using \"..\" sequences in the query string to read arbitrary files on the server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:43Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.95111,"percentile":0.99863,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-03-19","dueDate":"2025-04-09","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"SAP users must have an account to log in and access the patch: https://me.sap.com/notes/3476549 ; https://nvd.nist.gov/vuln/detail/CVE-2017-12637","provenance":"source"},"vulncheckKev":{"dateAdded":"2017-08-07","exploitedFirstSeen":"2017-08-07","ransomware":false,"evidence":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12637","date":"2017-08-07"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12637","date":"2017-08-07"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-03-19"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2017-12637","date":"2025-06-08"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-21&host_type=src&vulnerability=cve-2017-12637","date":"2026-09-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-24&host_type=src&vulnerability=cve-2017-12637","date":"2026-09-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-27&host_type=src&vulnerability=cve-2017-12637","date":"2026-09-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-28&host_type=src&vulnerability=cve-2017-12637","date":"2026-09-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-30&host_type=src&vulnerability=cve-2017-12637","date":"2026-09-30"}],"evidenceTotal":14,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12637","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev","ctid-cve"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute); CTID attack_to_cve (Phase 1)","mappingType":"exploitation_technique","evidence":[],"comment":"By exploiting this vulnerability in SAP Netweaver Java, the attacker can inject directory traversal commands, allowing for navigation of the file system beyond intended access. This can additionally lead to the discovery of password stores, as well as information about the host system, providing information that can be used in further attacks.","confidence":"high"},{"id":"T1083","name":"File and Directory Discovery","tactics":["discovery"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev","ctid-cve"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute); CTID attack_to_cve (Phase 1)","mappingType":"primary_impact","evidence":[],"comment":"By exploiting this vulnerability in SAP Netweaver Java, the attacker can inject directory traversal commands, allowing for navigation of the file system beyond intended access. This can additionally lead to the discovery of password stores, as well as information about the host system, providing information that can be used in further attacks.","confidence":"high"},{"id":"T1555","name":"Credentials from Password Stores","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"secondary_impact","evidence":[],"comment":"By exploiting this vulnerability in SAP Netweaver Java, the attacker can inject directory traversal commands, allowing for navigation of the file system beyond intended access. This can additionally lead to the discovery of password stores, as well as information about the host system, providing information that can be used in further attacks.","confidence":"high"},{"id":"T1592","name":"Gather Victim Host Information","tactics":["reconnaissance"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"secondary_impact","evidence":[],"comment":"By exploiting this vulnerability in SAP Netweaver Java, the attacker can inject directory traversal commands, allowing for navigation of the file system beyond intended access. This can additionally lead to the discovery of password stores, as well as information about the host system, providing information that can be used in further attacks.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-4176","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-4176","exploited":true,"exploitedSince":"2025-03-19","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-07-23","earliestUrl":"https://github.com/abrewer251/CVE-2017-12637_SAP-NetWeaver-URL-Traversal","repos":[{"name":"abrewer251/CVE-2017-12637_SAP-NetWeaver-URL-Traversal","url":"https://github.com/abrewer251/CVE-2017-12637_SAP-NetWeaver-URL-Traversal","stars":0,"created":"2025-07-23"}]},"nuclei":[{"id":"CVE-2017-12637","name":"SAP NetWeaver Application Server Java 7.5 - Local File Inclusion","severity":"high","path":"http/cves/2017/CVE-2017-12637.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12637.yaml"}],"first":{"date":"2025-07-23","source":"PoC-in-GitHub","url":"https://github.com/abrewer251/CVE-2017-12637_SAP-NetWeaver-URL-Traversal"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1083"],"provenance":"source"},{"stage":"secondary","techniques":["T1592","T1555"],"provenance":"source"}],"timeline":[{"date":"2017-08-07","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12637","provenance":"source"},{"date":"2017-08-07","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12637","provenance":"source"},{"date":"2025-03-19","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-03-19","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-4176","provenance":"source"},{"date":"2025-07-23","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/abrewer251/CVE-2017-12637_SAP-NetWeaver-URL-Traversal","provenance":"source"}],"speed":{"daysToPublicExploit":2907,"firstExploitFrom":"PoC-in-GitHub","daysToKev":2781},"priority":{"score":68.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3372 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9986"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-sap-netweaver-cwe-22"}}