High severity · published Jun 6, 2017
CVE-2017-5664
The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request…
7.5
CVSS
16.6%
EPSS
No
On KEV
Description
The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)16.6% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
Tomcat · Apache
9.0.0.M1 to 9.0.0.M20; 8.5.0 to 8.5.14; 8.0.0.RC1 to 8.0.43; 7.0.0 to 7.0.77 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-5664
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-5664
www.debian.org
http://www.debian.org/security/2017/dsa-3891
www.debian.org
http://www.debian.org/security/2017/dsa-3892
www.oracle.com
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
www.oracle.com
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
www.oracle.com
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
www.oracle.com
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
More from Tomcat
9.8
CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
9.8
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
9.8
CVE-2016-8735
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…
8.1
CVE-2017-12617
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g
8.1
CVE-2017-12615
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g
