{
  "id": "CVE-2017-12617",
  "url": "https://spydr.io/cve/CVE-2017-12617",
  "published": "2017-10-04T01:29:02.120Z",
  "modified": "2026-08-25T16:28:27.310Z",
  "score": 8.1,
  "severity": "high",
  "cvss_version": "3.1",
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "score_source": "NVD",
  "epss": 0.99968,
  "epss_percentile": 0.99977,
  "exploited": true,
  "kev": {
    "added": "2022-03-25",
    "due": "2022-04-15",
    "action": "Apply updates per vendor instructions.",
    "ransomware": "Unknown",
    "name": "Apache Tomcat Remote Code Execution Vulnerability",
    "notes": "https://nvd.nist.gov/vuln/detail/CVE-2017-12617"
  },
  "ssvc_exploitation": "active",
  "vendors": [
    "Apache Software Foundation"
  ],
  "products": [
    "Apache Software Foundation Apache Tomcat"
  ],
  "cwes": [
    "CWE-434"
  ],
  "description": "When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",
  "status": "Analyzed",
  "score_type": "Primary",
  "scores": {
    "cvss_v40": null,
    "cvss_v31": 8.1,
    "cvss_v30": null
  },
  "references": [
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://www.securityfocus.com/bid/100954",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ]
    },
    {
      "url": "http://www.securitytracker.com/id/1039552",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ]
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3080",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3081",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3113",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2017:3114",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:0268",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:0269",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:0270",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:0271",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:0275",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:0465",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:0466",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:2939",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E",
      "tags": [
        "Mailing List",
        "Patch"
      ]
    },
    {
      "url": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E",
      "tags": [
        "Mailing List",
        "Patch"
      ]
    },
    {
      "url": "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E",
      "tags": [
        "Mailing List",
        "Patch"
      ]
    },
    {
      "url": "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E",
      "tags": [
        "Mailing List",
        "Patch"
      ]
    },
    {
      "url": "https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb%40%3Cannounce.tomcat.apache.org%3E",
      "tags": [
        "Issue Tracking",
        "Mailing List"
      ]
    },
    {
      "url": "https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E",
      "tags": [
        "Mailing List",
        "Patch"
      ]
    },
    {
      "url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E",
      "tags": [
        "Mailing List",
        "Patch"
      ]
    },
    {
      "url": "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E",
      "tags": [
        "Mailing List",
        "Patch"
      ]
    }
  ],
  "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12617",
  "covered_in": [],
  "attribution": [
    {
      "source": "NVD",
      "url": "https://nvd.nist.gov",
      "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD."
    },
    {
      "source": "CISA KEV",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "notice": "Known exploited vulnerabilities from the CISA KEV catalog."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss",
      "notice": "Exploit prediction scores from FIRST EPSS."
    }
  ]
}