# CVE-2017-12637: SAP NetWeaver - Path Traversal

> Live exploitation tracking for CVE-2017-12637 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2017-12637

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** SAP NetWeaver
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** enterprise_software

## Description

Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.

## CrowdSec analysis

[CVE-2017-12637](https://euvd.enisa.europa.eu/vulnerability/CVE-2017-12637) is a directory traversal vulnerability affecting SAP NetWeaver Application Server Java, allowing remote attackers to read arbitrary files through crafted requests.

CrowdSec has been tracking this vulnerability and its exploits since 26th of March 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2017-12637 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
In addition, according to the CrowdSec network, attack volume against CVE-2017-12637 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attempts to exploit this vulnerability typically focus on URLs under `/scheduler/ui/js/ffffffffbca41eb4/uiutiljavascriptjs` containing traversal sequences.

## Timeline

- 2017-08-07: CVE Published. CVE-2017-12637 is published to NVD.
- 2025-03-19: CISA KEV. CVE-2017-12637 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2025-03-26: Rule Released. CrowdSec releases a rule to detect CVE-2017-12637 exploitation attempts against the CrowdSec Network.
- 2025-03-26: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2017-12637 for the first time.
- 2025-04-09: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12637.yaml
- https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2017-12637) follows observed exploitation activity for CVE-2017-12637. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.