CVE-2017-12637

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12637US Government Resource

Timeline

Published: Aug 7, 2017
Last modified: Jun 17, 2026
Added to CISA KEV: Mar 19, 2025
NVD status: Analyzed

Related CVEs from 2017

CVE-2017-126389.8Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspec CVE-2017-126399.8Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspec CVE-2017-12647.5IBM Security Guardium 10.0 does not prove or insufficiently proves that the actors identity is correct which can lead to exposure of resourc CVE-2017-126408.8ImageMagick 7.0.6-1 has an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c.CVE-2017-126418.8ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadOneJNGImage in coders\png.c.CVE-2017-126428.8ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadMPCImage in coders\mpc.c.CVE-2017-126436.5ImageMagick 7.0.6-1 has a memory exhaustion vulnerability in ReadOneJNGImage in coders\png.c.CVE-2017-126448.8ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadDCMImage in coders\dcm.c.CVE-2017-126456.1XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.CVE-2017-126466.1XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address.CVE-2017-126476.1XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title.CVE-2017-126486.1XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL.