High severity · published Oct 3, 2017
CVE-2017-12617
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g
In wildKEV
8.1
CVSS
100%
EPSS
Yes
On KEV
Description
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 25, 2022
Federal remediation dueApr 15, 2022
Ransomware campaign useNot known
Affected products
Which versions
TO
Tomcat · Apache
9.0.0.M1 to 9.0.0; 8.5.0 to 8.5.22; 8.0.0.RC1 to 8.0.46; 7.0.0 to 7.0.81 · source: vendor, NVD, KEV
AI
Active IQ Unified Manager · Netapp
7.3 and later; 9.5 and later · source: NVD
AP
Agile Product Lifecycle Management · Oracle
9.3.3; 9.3.4; 9.3.5; 9.3.6 · source: NVD
CI
Communications Instant Messaging Server · Oracle
10.0.1 · source: NVD
DL
Debian Linux · Debian
7.0 · source: NVD
EL
Element · Netapp
All versions, or not specified · source: NVD
EI
Endeca Information Discovery Integrator · Oracle
3.1.0; 3.2.0 · source: NVD
EL
Enterprise Linux Desktop · Redhat
6.0; 7.0 · source: NVD
EL
Enterprise Linux Eus · Redhat
7.4; 7.5; 7.6; 7.7 · source: NVD
EL
Enterprise Linux Eus Compute Node · Redhat
7.4; 7.5; 7.6; 7.7 · source: NVD
EL
Enterprise Linux For Ibm Z Systems · Redhat
6.0_s390x; 7.0_s390x · source: NVD
EL
Enterprise Linux For Ibm Z Systems Eus · Redhat
7.4_s390x; 7.5_s390x; 7.6_s390x; 7.7_s390x · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-12617
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-12617
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Patch
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
Patch
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Broken Link
http://www.securityfocus.com/bid/100954
Broken Link
http://www.securitytracker.com/id/1039552
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3080
More from Tomcat
9.8
CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
9.8
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
9.8
CVE-2016-8735
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…
8.1
CVE-2017-12615
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g
7.5
CVE-2026-34486
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor