7.5

CVE-2017-12616: apache software foundation apache tomcat

Modified
AliasesUBUNTU-CVE-2017-12616DLA-1108-1GHSA-8qq4-8jvq-mfw4
Published 19-09-2017Last modified 15-10-2026

Vulnerability summary

CVE-2017-12616 is a high (CVSS 7.5) vulnerability in apache software foundation apache tomcat. EPSS estimates a 70.12% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 70% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.0 (NVD)
EPSS score
70.12%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 3
DLA-1400-1MGASA-2017-0352RHSA-2018:0466SUSE-SU-2017:3059-1USN-3665-1USN-7282-1

Timeline

  1. 19-09-2017
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

70.12%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

No change 0.00 pp

From 70.12% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Apache1 product
  • tomcatEOL7.0.0 | 7.0.0:beta | 7.0.1 | 7.0.2 | 7.0.2:beta | 7.0.3 | 7.0.4 | 7.0.4:beta | 7.0.5 | 7.0.5:beta | 7.0.6 | 7.0.7 | 7.0.8 | 7.0.9 | 7.0.10 | 7.0.11 | 7.0.12 | 7.0.13 | 7.0.14 | 7.0.15 | 7.0.16 | 7.0.17 | 7.0.18 | 7.0.19 | 7.0.20 | 7.0.21 | 7.0.22 | 7.0.23 | 7.0.24 | 7.0.25 | 7.0.26 | 7.0.27 | 7.0.28 | 7.0.29 | 7.0.30 | 7.0.31 | 7.0.32 | 7.0.33 | 7.0.34 | 7.0.35 | 7.0.36 | 7.0.37 | 7.0.38 | 7.0.39 | 7.0.40 | 7.0.41 | 7.0.42 | 7.0.43 | 7.0.44 | 7.0.45 | 7.0.46 | 7.0.47 | 7.0.48 | 7.0.49 | 7.0.50 | 7.0.51 | 7.0.54 | 7.0.55 | 7.0.56 | 7.0.57 | 7.0.58 | 7.0.59 | 7.0.60 | 7.0.61 | 7.0.62 | 7.0.63 | 7.0.64 | 7.0.65 | 7.0.66 | 7.0.67 | 7.0.68 | 7.0.69 | 7.0.70 | 7.0.71 | 7.0.72 | 7.0.73 | 7.0.74 | 7.0.75 | 7.0.76 | 7.0.77 | 7.0.79 | 7.0.80
Apache software foundation1 product
Debian1 product
  • tomcat7< 7.0.28-4+deb7u15
Org.apache.tomcat1 product
  • tomcat-catalina≥ 7.0.0, < 7.0.81
Ubuntu1 product
  • tomcat7< 7.0.52-1ubuntu0.14 | < 7.0.68-1ubuntu0.4+esm3 | All versions (No fix recorded)

5 vendors · 5 products

References

28 links
Show all 28 references