{"id":"CVE-2017-12637","vendor_project":"SAP","product":"NetWeaver","vulnerability_name":"SAP NetWeaver Directory Traversal Vulnerability","date_added":"2025-03-19","due_date":"2025-04-09","known_ransomware_use":"Unknown","short_description":"SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":"CWE-22","cvss_version":"3.1","cvss_severity":"HIGH","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","nvd_published":"2017-08-07","nvd_status":"Analyzed","epss":0.95111,"epss_percentile":0.99861,"cvss_score":7.5,"days_published_to_kev":2781,"source":"https://data.cybermax-tools.workers.dev/cve/CVE-2017-12637","by":"CyberMax"}