CVE-2017-12615highunder attackransomwareCWE-434

CVE-2017-12615: high-severity vulnerability in Apache Tomcat

Published · Updated

Follow this CVE+ Monitor Apache Tomcat+ Monitor org.apache.tomcat.embed:tomcat-embed-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.1epss 100%
from disclosure to weapon1 day
Published on NVDSep 19
1st PoC+1d
CISA KEV+1648d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
20 products (267 components)
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server · Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server · Red Hat JBoss Web Server 3.1 for RHEL 6 · Red Hat JBoss Web Server 3.1 for RHEL 7 · Red Hat Enterprise Linux Desktop Optional (v. 6) · and others 15
fix ↗
Not affected
7 products (11 components) — because the vulnerable code is not present in the product
Red Hat Software Collections · Red Hat JBoss Data Grid 6 · Red Hat JBoss Data Virtualization 6 · Red Hat JBoss Enterprise Application Platform 6 · Red Hat JBoss Fuse 6 · and others 2
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

Apache Tomcat on Windows allows uploading JSP files when HTTP PUT requests are enabled, letting attackers execute arbitrary code on the server. This is critical because it gives attackers complete control over the web application.

Technical detail

CWE-434 (Unrestricted File Upload) vulnerability in Tomcat 7.0.0–7.0.79 on Windows systems with readonly=false. Attackers can craft HTTP PUT requests to upload JSP files to web-accessible directories, which are then executed with server privileges. No authentication required if PUT is enabled; impact is remote code execution.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache Tomcat
public PoCs found — 36
exploitdbwww.exploit-db.com/exploits/42953unverifiedgithubgithub.com/lizhianyuguangming/TomcatScanPro★ 297githubgithub.com/tpt11fb/AttackTomcat★ 258githubgithub.com/breaktoprotect/CVE-2017-12615★ 112githubgithub.com/xiaokp7/Tomcat_PUT_GUI_EXP★ 11githubgithub.com/mefulton/cve-2017-12615★ 10githubgithub.com/zi0Black/POC-CVE-2017-12615-or-CVE-2017-12717★ 6githubgithub.com/1337g/CVE-2017-12615★ 4githubgithub.com/wsg00d/cve-2017-12615★ 3githubgithub.com/ianxtianxt/CVE-2017-12615★ 1githubgithub.com/BeyondCy/CVE-2017-12615★ 1githubgithub.com/w0x68y/CVE-2017-12615-EXP★ 1githubgithub.com/nouhaila2030/apache-tomcat-security-audit★ 0githubgithub.com/netw0rk7/CVE-2017-12615-Home-Lab★ 0githubgithub.com/cved-sources/cve-2017-12615★ 0githubgithub.com/cyberharsh/Tomcat-CVE-2017-12615★ 0githubgithub.com/edyekomu/CVE-2017-12615-PoC★ 0githubgithub.com/Fa1c0n35/CVE-2017-12615★ 0githubgithub.com/K3ysTr0K3R/CVE-2017-12615★ 0githubgithub.com/Shellkeys/CVE-2017-12615★ 0githubgithub.com/CyberCTF/vulhub-tomcat-cve-2017-12615★ 0githubgithub.com/wudidwo/CVE-2017-12615-poc★ 0vulncheckvulncheck.com/xdb/c6c5d207cd19unverifiedvulncheckvulncheck.com/xdb/814d0fdfdaf9unverifiedvulncheckvulncheck.com/xdb/6889df0c7813unverifiedvulncheckvulncheck.com/xdb/08d6bfd35adcunverifiedvulncheckvulncheck.com/xdb/5a1624c6df1bunverifiedvulncheckvulncheck.com/xdb/b6f4790733eaunverifiedvulncheckvulncheck.com/xdb/1f8fb8c68353unverifiedvulncheckvulncheck.com/xdb/990330be271funverifiedvulncheckvulncheck.com/xdb/8d7305eb7051unverifiedvulncheckvulncheck.com/xdb/fbbcc0b93b98unverifiedvulncheckvulncheck.com/xdb/3e4c49fc05beunverifiedvulncheckvulncheck.com/xdb/70d9deaae392unverifiedcve_referencewww.exploit-db.com/exploits/42953/unverifiedvulncheckvulncheck.com/xdb/e05744e25040unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache Tomcat

In the same product, most dangerous first.

CVE-2017-12617HIGHCVE-2017-12617EPSS 100.0%KEVCVE-2025-24813CRITICALApache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTEPSS 99.9%KEVCVE-2026-34486HIGHApache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorEPSS 98.5%KEVCVE-2016-8735CRITICALCVE-2016-8735EPSS 90.3%KEVCVE-2018-11784—CVE-2018-11784EPSS 97.7%CVE-2021-33037—Incorrect Transfer-Encoding handling with HTTP/1.0EPSS 74.7%