CVE-2017-12615: Apache Tomcat on Windows Remote Code Execution Vulnerability
Vulnerability summary
CVE-2017-12615 is a high (CVSS 8.1) vulnerability in Apache Tomcat. It is known to be exploited: CISA lists it, first on 25-03-2022. It has been used in ransomware campaigns. EPSS estimates a 99.71% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 3 public exploits are recorded.
Known ransomware use (CISA, 25-03-2022)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 1Timeline
- 19-09-2017PublishedVulnerability first disclosed.
- 25-03-2022Added to CISA KEVExploitedApache Tomcat on Windows Remote Code Execution Vulnerability
- 15-04-2022CISA remediation dueDeadline passedApply updates per vendor instructions.
- 06-08-2026Last modifiedVulnerability information updated.
Description
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVSS metrics
4 scores · 3 sources · 3 versions- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
99.71%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
Increase +0.07 pp
From 99.64% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 25-03-2022
- Federal due date
- 15-04-2022
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2017-12615
Public exploits
3 foundCve 2017 12615
Maturity: poc
Exploit Reference (breaktoprotect.blogspot.com)
Maturity: unknown
Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1)
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat18 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_eus7.4 | 7.5 | 7.6 | 7.7
- enterprise_linux_eus_compute_node7.4 | 7.5 | 7.6 | 7.7
- enterprise_linux_for_ibm_z_systems7.0_s390x
- enterprise_linux_for_ibm_z_systems_eus7.4_s390x | 7.5_s390x | 7.6_s390x | 7.7_s390x
Netapp3 products
Apache1 product
- tomcat≥ 7.0.0, ≤ 7.0.79
Apache software foundation1 product
- apache tomcat7.0.0 to 7.0.79
Org.apache.tomcat.embed1 product
- tomcat-embed-core≥ 7.0.0, < 7.0.79
5 vendors · 24 products
References
30 links- www.synology.com/support/security/Synology_SA_17_54_TomcatX Refsource CONFIRMThird Party AdvisoryWEB
- breaktoprotect.blogspot.com/2017/09/the-case-of-cve-2017-12615-tomcat-7-put.htmlX Refsource MISCExploitWEB
Show all 30 references
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12615Government ResourceUS Government ResourceWEB
