SAP NetWeaver - Path Traversal (CVE-2017-12637)
Description
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
psychologyCrowdSec Analysis
CVE-2017-12637 is a directory traversal vulnerability affecting SAP NetWeaver Application Server Java, allowing remote attackers to read arbitrary files through crafted requests.
CrowdSec has been tracking this vulnerability and its exploits since 26th of March 2025.
Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2017-12637 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. In addition, according to the CrowdSec network, attack volume against CVE-2017-12637 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Attempts to exploit this vulnerability typically focus on URLs under /scheduler/ui/js/ffffffffbca41eb4/uiutiljavascriptjs containing traversal sequences.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2017-08-07 |
| CISA KEV | 2025-03-19 |
| Rule Released | 2025-03-26 |
| CrowdSec First Seen | 2025-03-26 |
| CISA Remediation Deadline | 2025-04-09 |