SAP NetWeaver Directory Traversal Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 19/03/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| netweaver application server java | = 7.50 |
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free