CVE-2017-12617

Aliases:GHSA-xjgh-84hx-56c5
Advisory lineage Upstream: 0 Downstream: 19
Analyzed
Published: 03 Oct 2017, 15:00
Last modified:21 Oct 2025, 23:55

Vulnerability Summary

Overall Risk (default)
high
61/100
CVSS Score
8.1 HIGH
v3.1 (cve.org)
EPSS Score
94.38% CRITICAL
94% probability +0.02%
KEV
Listed
CISA
1 listing
Ransomware
No reports
Public exploits
3 found
Dark Web
Not detected

Timeline

03 Oct 2017, 15:00
Published
Vulnerability first disclosed
25 Mar 2022, 00:00
Added to CISA KEV
Apache Tomcat Remote Code Execution Vulnerability
15 Apr 2022, 00:00
CISA Remediation Due
Apply updates per vendor instructions.
21 Oct 2025, 23:55
Last Modified
Vulnerability information updated

Description

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

CVSS Metrics

  • v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v3.0•HIGH•Score: 8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
  • v2.0•MEDIUM•Score: 6.8AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 94.38%• Percentile: 100%

Techniques & Countermeasures

  • CWE-434•Unrestricted Upload of File with Dangerous Type

    The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Affected Systems

  • apache software foundation•apache tomcat

    9.0.0.M1 to 9.0.0 | 8.5.0 to 8.5.22 | 8.0.0.RC1 to 8.0.46 | 7.0.0 to 7.0.81

  • Unknown•Tomcat

    ≥ 7.0.0, < 7.0.82 | ≥ 8.0, < 8.0.47 | ≥ 8.5.0, < 8.5.23 | ≥ 9.0.0, < 9.0.1

  • canonical•ubuntu_linux

    12.04 | 16.04 | 17.10 | 18.04

  • debian•debian_linux

    7.0

  • org.apache.tomcat•tomcat-catalina

    ≥ 9.0.0.M1, < 9.0.1 | ≥ 8.5.0, < 8.5.23 | ≥ 8.0.0-RC1, < 8.0.47 | ≥ 7.0.0, < 7.0.82

  • org.apache.tomcat.embed•tomcat-embed-core

    ≥ 9.0.0.M1, < 9.0.1 | ≥ 8.5.0, < 8.5.23 | ≥ 8.0.0-RC1, < 8.0.47 | ≥ 7.0.0, < 7.0.82

  • netapp•active_iq_unified_manager

    ≥ 7.3 | ≥ 9.5

  • netapp•element

    na

  • netapp•oncommand_balance

    na

  • netapp•oncommand_insight

    na

  • netapp•oncommand_shift

    na

  • netapp•oncommand_workflow_automation

    na

  • netapp•snapcenter

    na

  • oracle•agile_plm

    9.3.3 | 9.3.4 | 9.3.5 | 9.3.6

  • oracle•communications_instant_messaging_server

    10.0.1

  • oracle•endeca_information_discovery_integrator

    3.1.0 | 3.2.0

  • oracle•enterprise_manager_for_mysql_database

    12.1.0.4.0

  • oracle•financial_services_analytical_applications_infrastructure

    ≥ 7.3.3.0.0, ≤ 7.3.5.3.0 | ≥ 8.0.0.0.0, ≤ 8.0.9.0.0

  • oracle•fmw_platform

    12.2.1.2.0 | 12.2.1.3.0

  • oracle•health_sciences_empirica_inspections

    1.0.1.1

  • oracle•hospitality_guest_access

    4.2.0 | 4.2.1

  • oracle•instantis_enterprisetrack

    17.1 | 17.2

  • oracle•management_pack

    11.2.1.0.13

  • oracle•micros_lucas

    2.9.5

  • oracle•micros_retail_xbri_loss_prevention

    10.0.1 | 10.5.0 | 10.6.0 | 10.7.0 | 10.8.0 | 10.8.1

  • oracle•mysql_enterprise_monitor

    ≤ 3.3.6.3293 | ≥ 3.4.0, ≤ 3.4.4.4226 | ≥ 4.0.0, ≤ 4.0.0.5135

  • oracle•retail_advanced_inventory_planning

    13.2 | 13.4 | 14.1 | 15.0

  • oracle•retail_back_office

    14.0.4 | 14.1.3

  • oracle•retail_central_office

    14.0.4 | 14.1.3

  • oracle•retail_convenience_and_fuel_pos_software

    2.1.132

  • oracle•retail_eftlink

    1.1.124 | 15.0.1 | 16.0.2

  • oracle•retail_insights

    14.0 | 14.1 | 15.0 | 16.0

  • oracle•retail_invoice_matching

    12.0 | 13.0 | 13.1 | 13.2 | 14.0 | 14.1 | 15.0 | 16.0

  • oracle•retail_order_broker

    5.0 | 5.1 | 5.2 | 15.0 | 16.0

  • oracle•retail_order_management_system

    4.0 | 4.5 | 4.7 | 5.0

  • oracle•retail_point-of-service

    14.0.4 | 14.1.3

  • oracle•retail_price_management

    12.0 | 13.0 | 13.1 | 13.2 | 14.0 | 14.1 | 15.0 | 16.0

  • oracle•retail_returns_management

    2.3.8 | 2.4.9 | 14.0.4 | 14.1.3

  • oracle•retail_store_inventory_management

    12.0.12 | 13.0.7 | 13.1.9 | 13.2.9 | 14.0.4 | 14.1.3 | 15.0.2 | 16.0.1

  • oracle•retail_xstore_point_of_service

    6.0.11 | 7.0.6 | 7.1.6 | 15.0.1

  • oracle•transportation_management

    6.3.1 | 6.3.2 | 6.3.3 | 6.3.4 | 6.3.5 | 6.3.6 | 6.3.7

  • oracle•tuxedo_system_and_applications_monitor

    12.1.3.0.0

  • oracle•webcenter_sites

    11.1.1.8.0

  • oracle•workload_manager

    12.2.0.1

  • redhat•enterprise_linux_desktop

    6.0 | 7.0

  • redhat•enterprise_linux_eus

    7.4 | 7.5 | 7.6 | 7.7

  • redhat•enterprise_linux_eus_compute_node

    7.4 | 7.5 | 7.6 | 7.7

  • redhat•enterprise_linux_for_ibm_z_systems

    6.0_s390x | 7.0_s390x

  • redhat•enterprise_linux_for_ibm_z_systems_eus

    7.4_s390x | 7.5_s390x | 7.6_s390x | 7.7_s390x

  • redhat•enterprise_linux_for_power_big_endian

    6.0_ppc64 | 7.0_ppc64

Showing first 50 affected entries in server-rendered view.

References (89)