How severe is CVE-2017-12637?

CVE-2017-12637 has a CVSS 3.1 base score of 7.5 (HIGH). EPSS estimates a 95.1% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2017-12637: SAP NetWeaver Directory Traversal Vulnerability

CISA Known Exploited Vulnerabilities

SAP NetWeaver Directory Traversal Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2025-03-19

Remediation due

2025-04-09

Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA notes
SAP users must have an account to log in and access the patch: https://me.sap.com/notes/3476549 ; https://nvd.nist.gov/vuln/detail/CVE-2017-12637

Description

Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.

Severity

CVSS 3.1 · CISA7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impactpartial

Exploitation Context

as of October 13, 2026

All KEV statistics→

CISA added CVE-2017-12637 to the KEV catalog 2,781 days after its CVE record was published. The median for entries added in 2025 is 26 days.
It is one of 14 SAP entries in the CISA KEV catalog, and one of 3 added in 2025.
Its current EPSS score (95.1%) is higher than that of 78% of CISA KEV entries.

Affected Products

Vendor	Product	Affected versions
-	-	n/a

References

1 Links

Other references

https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/

Record Details

Published

2017-08-07

Last updated

2025-10-21

Assigner (CNA)

mitre

Credited to

More from SAP

All SAP CVEs→

CVE-2025-3132410 CRITICAL

Missing Authorization check in SAP NetWeaver (Visual Composer development server)

SAP_SEKEVEPSS 99.5%2025-04-24

CVE-2020-628710 CRITICAL

SAP NetWeaver Missing Authentication for Critical Function Vulnerability

SAP SEKEVEPSS 94.7%2020-07-14

CVE-2016-23869.8 CRITICAL

SAP NetWeaver SQL Injection Vulnerability

KEVEPSS 71.5%2016-02-16

CVE-2016-23885.3 MEDIUM

SAP NetWeaver Information Disclosure Vulnerability

KEVEPSS 52.2%2016-02-16

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.