CVE-2017-12615
Apache Software Foundation Apache Tomcat
Published 19 Sept 2017 · updated 6 Aug 2026 · Analyzed
8.1 High · CVSS 3.1, NVD
Exploited in the wild
CISA added this to its Known Exploited Vulnerabilities catalog on 25 Mar 2022, with a remediation deadline of 15 Apr 2022 for US federal agencies. It has been used in ransomware campaigns.
Required action: Apply updates per vendor instructions.
Description
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
References
- breaktoprotect.blogspot.com/2017/09/the-case-of-cve-2017-12615-tomcat-7-put.html · Exploit
- www.securityfocus.com/bid/100901 · Broken Link, Third Party Advisory, VDB Entry
- www.securitytracker.com/id/1039392 · Broken Link, Third Party Advisory, VDB Entry
- access.redhat.com/errata/RHSA-2017:3080 · Third Party Advisory
- access.redhat.com/errata/RHSA-2017:3081 · Third Party Advisory
- access.redhat.com/errata/RHSA-2017:3113 · Third Party Advisory
- access.redhat.com/errata/RHSA-2017:3114 · Third Party Advisory
- access.redhat.com/errata/RHSA-2018:0465 · Third Party Advisory
- access.redhat.com/errata/RHSA-2018:0466 · Third Party Advisory
- github.com/breaktoprotect/CVE-2017-12615 · Exploit, Third Party Advisory
- lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E · Mailing List, Patch
- lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E · Mailing List, Patch
- lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E · Mailing List, Patch
- lists.apache.org/thread.html/8fcb1e2d5895413abcf266f011b9918ae03e0b7daceb118ffbf23f8c%40%3Cannounce.tomcat.apache.org%3E · Issue Tracking, Mailing List
- lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E · Mailing List
- lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E · Mailing List, Patch
- security.netapp.com/advisory/ntap-20171018-0001/ · Third Party Advisory
- www.exploit-db.com/exploits/42953/ · Third Party Advisory, VDB Entry
- www.synology.com/support/security/Synology_SA_17_54_Tomcat · Third Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12615 · US Government Resource