Sign-up

ID

VAR-201708-0889


CVE

CVE-2017-12637


TITLE

SAP NetWeaver Application Server Java Path traversal vulnerability

Trust: 1.4

sources: JVNDB: JVNDB-2017-006983 // CNNVD: CNNVD-201708-277

DESCRIPTION

Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657. Attacks on this vulnerability 2017 Year 8 Observed on the moon. Vendors have confirmed this vulnerability SAP Security Note 2486657 It is released as.Information may be obtained

Trust: 1.71

sources: NVD: CVE-2017-12637 // JVNDB: JVNDB-2017-006983 // VULMON: CVE-2017-12637

AFFECTED PRODUCTS

vendor:sapmodel:netweaver application server javascope:eqversion:7.50

Trust: 1.0

vendor:sapmodel:netweaver application server javascope:eqversion:7.5

Trust: 0.8

vendor:sapmodel:netweaverscope:eqversion:7.50

Trust: 0.6

sources: JVNDB: JVNDB-2017-006983 // CNNVD: CNNVD-201708-277 // NVD: CVE-2017-12637

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-12637
value: HIGH

Trust: 1.0

NVD: CVE-2017-12637
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201708-277
value: HIGH

Trust: 0.6

VULMON: CVE-2017-12637
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-12637
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

nvd@nist.gov: CVE-2017-12637
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2017-12637
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULMON: CVE-2017-12637 // JVNDB: JVNDB-2017-006983 // CNNVD: CNNVD-201708-277 // NVD: CVE-2017-12637

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.8

sources: JVNDB: JVNDB-2017-006983 // NVD: CVE-2017-12637

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201708-277

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-201708-277

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-006983

PATCH
title:August 2017 (2486657)url:https://blogs.sap.com/2017/08/08/sap-security-patch-day-august-2017/
Trust: 0.8
title:Nuclei Templates
Resourcesurl:https://github.com/merlinepedra25/nuclei-templates 
Trust: 0.1
title:Nuclei Templates
Resourcesurl:https://github.com/merlinepedra/nuclei-templates 
Trust: 0.1
title:Kenzer Templates [1289]url:https://github.com/Elsfa7-110/kenzer-templates 
Trust: 0.1
title:Kenzer Templates [5170] [DEPRECATED]url:https://github.com/ARPSyndicate/kenzer-templates 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2017-12637 // 
            
            
            
            JVNDB: JVNDB-2017-006983

EXTERNAL IDS
db:NVDid:CVE-2017-12637
Trust: 2.5
db:JVNDBid:JVNDB-2017-006983
Trust: 0.8
db:CNNVDid:CNNVD-201708-277
Trust: 0.6
db:VULMONid:CVE-2017-12637
Trust: 0.1
sources:
            
            
            VULMON: CVE-2017-12637 // 
            
            
            
            JVNDB: JVNDB-2017-006983 // 
            
            
            
            CNNVD: CNNVD-201708-277 // 
            
            
            
            NVD: CVE-2017-12637

REFERENCES
url:http://www.sh0w.top/index.php/archives/7/
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12637
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-12637
Trust: 0.8
url:https://www.onapsis.com/blog/sap-security-notes-august-2017-remote-code-injection-vulnerability-java-component
Trust: 0.8
url:https://cwe.mitre.org/data/definitions/22.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://github.com/merlinepedra25/nuclei-templates
Trust: 0.1
url:https://github.com/arpsyndicate/kenzer-templates
Trust: 0.1
sources:
            
            
            VULMON: CVE-2017-12637 // 
            
            
            
            JVNDB: JVNDB-2017-006983 // 
            
            
            
            CNNVD: CNNVD-201708-277 // 
            
            
            
            NVD: CVE-2017-12637

SOURCES
db:VULMONid:CVE-2017-12637
db:JVNDBid:JVNDB-2017-006983
db:CNNVDid:CNNVD-201708-277
db:NVDid:CVE-2017-12637

LAST UPDATE DATE
2024-11-23T22:17:49.948000+00:00

SOURCES UPDATE DATE
db:VULMONid:CVE-2017-12637date:2024-02-14T00:00:00
db:JVNDBid:JVNDB-2017-006983date:2017-09-07T00:00:00
db:CNNVDid:CNNVD-201708-277date:2021-04-22T00:00:00
db:NVDid:CVE-2017-12637date:2024-11-21T03:09:56.703

SOURCES RELEASE DATE
db:VULMONid:CVE-2017-12637date:2017-08-07T00:00:00
db:JVNDBid:JVNDB-2017-006983date:2017-09-07T00:00:00
db:CNNVDid:CNNVD-201708-277date:2017-08-10T00:00:00
db:NVDid:CVE-2017-12637date:2017-08-07T20:29:01.120