CVEvulnerability

CVE-2017-12617

8.1 HIGH Known exploited Published 2017-10-04 Modified 2026-08-25 Official page ↗

CISA Known Exploited Vulnerability

Apache Tomcat Remote Code Execution Vulnerability — Apache Tomcat

When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Added to KEV: 2022-03-25
Remediation due: 2022-04-15
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2017-12617

Status: Analyzed
Published: 2017-10-04
Last modified: 2026-08-25
Assigner: [email protected]
CVSS 3.1 ([email protected]): 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses: CWE-434

Description

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Affected configurations

• apache tomcat (>= 7.0.0 < 7.0.82) • apache tomcat (>= 8.0 < 8.0.47) • apache tomcat (>= 8.5.0 < 8.5.23) • apache tomcat (>= 9.0.0 < 9.0.1) • canonical ubuntu linux 12.04 • canonical ubuntu linux 16.04 • canonical ubuntu linux 17.10 • canonical ubuntu linux 18.04 • oracle agile product lifecycle management 9.3.3 • oracle agile product lifecycle management 9.3.4 • oracle agile product lifecycle management 9.3.5 • oracle agile product lifecycle management 9.3.6 • oracle communications instant messaging server 10.0.1 • oracle endeca information discovery integrator 3.1.0 • oracle endeca information discovery integrator 3.2.0 • oracle enterprise manager for mysql database 12.1.0.4.0 • oracle financial services analytical applications infrastructure (>= 7.3.3.0.0 <= 7.3.5.3.0) • oracle financial services analytical applications infrastructure (>= 8.0.0.0.0 <= 8.0.9.0.0) • oracle fmw platform 12.2.1.2.0 • oracle fmw platform 12.2.1.3.0 • oracle health sciences empirica inspections 1.0.1.1 • oracle hospitality guest access 4.2.0 • oracle hospitality guest access 4.2.1 • oracle instantis enterprisetrack 17.1 • oracle instantis enterprisetrack 17.2 • oracle management pack 11.2.1.0.13 • oracle micros lucas 2.9.5 • oracle micros retail xbri loss prevention 10.0.1 • oracle micros retail xbri loss prevention 10.5.0 • oracle micros retail xbri loss prevention 10.6.0 • oracle micros retail xbri loss prevention 10.7.0 • oracle micros retail xbri loss prevention 10.8.0 • oracle micros retail xbri loss prevention 10.8.1 • oracle mysql enterprise monitor (<= 3.3.6.3293) • oracle mysql enterprise monitor (>= 3.4.0 <= 3.4.4.4226) • oracle mysql enterprise monitor (>= 4.0.0 <= 4.0.0.5135) • oracle retail advanced inventory planning 13.2 • oracle retail advanced inventory planning 13.4 • oracle retail advanced inventory planning 14.1 • oracle retail advanced inventory planning 15.0 • oracle retail back office 14.0.4 • oracle retail back office 14.1.3 • oracle retail central office 14.0.4 • oracle retail central office 14.1.3 • oracle retail convenience and fuel pos software 2.1.132 • oracle retail eftlink 1.1.124 • oracle retail eftlink 15.0.1 • oracle retail eftlink 16.0.2 • oracle retail insights 14.0 • oracle retail insights 14.1 • oracle retail insights 15.0 • oracle retail insights 16.0 • oracle retail invoice matching 12.0 • oracle retail invoice matching 13.0 • oracle retail invoice matching 13.1 • oracle retail invoice matching 13.2 • oracle retail invoice matching 14.0 • oracle retail invoice matching 14.1 • oracle retail invoice matching 15.0 • oracle retail invoice matching 16.0 … and 97 more

Weakness · CWE (1)

CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References