GitHub Advisoryadvisory · Maven

GHSA-xjgh-84hx-56c5 Unrestricted Upload of File with Dangerous Type Apache Tomcat

HIGH Published 2022-05-14 Modified 2025-10-22 Official page ↗
Aliases
CVE-2017-12617
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat-catalina, org.apache.tomcat.embed:tomcat-embed-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weaknesses
CWE-434
Reviewed
2022-07-01

Affected packages

• Maven org.apache.tomcat:tomcat-catalina: >= 9.0.0.M1, < 9.0.1 → fixed in 9.0.1 • Maven org.apache.tomcat:tomcat-catalina: >= 8.5.0, < 8.5.23 → fixed in 8.5.23 • Maven org.apache.tomcat:tomcat-catalina: >= 8.0.0-RC1, < 8.0.47 → fixed in 8.0.47 • Maven org.apache.tomcat:tomcat-catalina: >= 7.0.0, < 7.0.82 → fixed in 7.0.82 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 9.0.0.M1, < 9.0.1 → fixed in 9.0.1 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 8.5.0, < 8.5.23 → fixed in 8.5.23 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 8.0.0-RC1, < 8.0.47 → fixed in 8.0.47 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 7.0.0, < 7.0.82 → fixed in 7.0.82

Description

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Related

Alias · CVE (1)

  • CVE-2017-12617 When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References