SAP NetWeaver AS JAVA 7.5 Query String UIUtilJavaScriptJS path traversal

Summaryinfo

A vulnerability was found in SAP NetWeaver AS JAVA 7.5. It has been classified as critical. This impacts an unknown function of the file scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS of the component Query String Handler. Performing a manipulation results in path traversal. This vulnerability is cataloged as CVE-2017-12637. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is suggested to use restrictive firewalling.

Detailsinfo

A vulnerability classified as critical has been found in SAP NetWeaver AS JAVA 7.5 (Solution Stack Software). This affects an unknown code block of the file scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS of the component Query String Handler. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, and integrity. The summary by CVE is:

Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017.

The bug was discovered 08/07/2017. The weakness was shared 08/07/2017 (Website). The advisory is shared at sh0w.top. This vulnerability is uniquely identified as CVE-2017-12637 since 08/07/2017. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a private exploit are known. MITRE ATT&CK project uses the attack technique T1006 for this issue.

It is declared as attacked. The vulnerability scanner Nessus provides a plugin with the ID 233477 (SAP NetWeaver AS Java Path Traversal (CVE-2017-12637)), which helps to determine the existence of the flaw in a target environment. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 03/19/2025 with a due date of 04/09/2025:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

It is possible to mitigate the weakness by firewalling .

The vulnerability is also documented in the vulnerability database at Tenable (233477). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Solution Stack Software

Vendor

• SAP

Name

• NetWeaver AS JAVA

Version

• 7.5

License

• commercial

Website

• Vendor: https://www.sap.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion