Login Request a demo
High severity · published Sep 19, 2017
CVE-2017-12615
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g
RansomwareIn wildKEV
8.1
CVSS
99.7%
EPSS
Yes
On KEV
Description
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.7% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 25, 2022
Federal remediation dueApr 15, 2022
Ransomware campaign useKnown
Affected products
Which versions
TO
Tomcat · Apache
7.0.0 to 7.0.79 · source: vendor, NVD, KEV
7T
7-mode Transition Tool · Netapp
All versions, or not specified · source: NVD
EL
Enterprise Linux Desktop · Redhat
6.0; 7.0 · source: NVD
EL
Enterprise Linux Eus · Redhat
7.4; 7.5; 7.6; 7.7 · source: NVD
EL
Enterprise Linux Eus Compute Node · Redhat
7.4; 7.5; 7.6; 7.7 · source: NVD
EL
Enterprise Linux For Ibm Z Systems · Redhat
7.0_s390x · source: NVD
EL
Enterprise Linux For Ibm Z Systems Eus · Redhat
7.4_s390x; 7.5_s390x; 7.6_s390x; 7.7_s390x · source: NVD
EL
Enterprise Linux For Power Big Endian · Redhat
7.0_ppc64 · source: NVD
EL
Enterprise Linux For Power Big Endian Eus · Redhat
7.4_ppc64; 7.5_ppc64; 7.6_ppc64; 7.7_ppc64 · source: NVD
EL
Enterprise Linux For Power Little Endian · Redhat
7.0_ppc64le · source: NVD
EL
Enterprise Linux For Power Little Endian Eus · Redhat
7.4_ppc64le; 7.5_ppc64le; 7.6_ppc64le; 7.7_ppc64le · source: NVD
EL
Enterprise Linux For Scientific Computing · Redhat
7.0 · source: NVD
Affected product
TO
Tomcat
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-12615
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-12615
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Exploit
http://breaktoprotect.blogspot.com/2017/09/the-case-of-cve-2017-12615-tomcat-7-put.html
Broken Link
http://www.securityfocus.com/bid/100901
Broken Link
http://www.securitytracker.com/id/1039392
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3080
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3081
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3113
More from Tomcat
9.8
CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
9.8
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
9.8
CVE-2016-8735
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…
8.1
CVE-2017-12617
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g
7.5
CVE-2026-34486
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor