CVE-2017-12637

CVE-2017-12637 is an unauthenticated directory traversal flaw (CWE-22) in the scheduler UI endpoint scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS of SAP NetWeaver Application Server Java 7.5. A remote attacker triggers it by inserting dot-dot (../) sequences into the query string of that endpoint, causing the server to read files outside the intended directory. Successful exploitation yields arbitrary file disclosure on the server (e.g., configuration files or credentials), with no authentication or user interaction required, consistent with the CVSS 3.1 score of 7.5 (High, network vector, confidentiality-only impact). Organizations running SAP NetWeaver Application Server Java 7.5 are affected, particularly internet-exposed instances such as SAP Enterprise Portal or Process Integration/Orchestration landscapes. The flaw was exploited in the wild as early as August 2017 and addressed via SAP Security Note 2486657; CISA added it to the Known Exploited Vulnerabilities catalog on 2025-03-19, and EPSS currently assigns a 95.1% probability of exploitation within 30 days (100th percentile).

What to do: Apply the fix from SAP Security Note 2486657 to affected Application Server Java 7.5 systems; where patching is not yet possible, restrict or block access to the scheduler UI path (scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS) and limit internet exposure of AS Java. Hunt for exploitation by reviewing web logs for dot-dot (../) traversal sequences in query strings targeting that endpoint, and follow CISA BOD 22-01 guidance for cloud services or the KEV required action if mitigations are unavailable.