CVE-2017-12617highunder attackCWE-434

CVE-2017-12617: high-severity vulnerability in Apache Tomcat

Published · Updated

Follow this CVE+ Monitor Apache Tomcat+ Monitor org.apache.tomcat.embed:tomcat-embed-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.1epss 100%
from disclosure to weapon2 days
Published on NVDOct 3
1st PoC+2d
metasploitOct 3
CISA KEV+1634d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
2 products
Red Hat Enterprise Linux 5 · Red Hat JBoss Enterprise Application Platform 5
workaround: Ensure that readonly is set to true (the default) for the DefaultServlet, WebDAV servlet or application context. Block HTTP methods that permit resource modification for untrusted users.
Fixed
25 products (743 components)
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server · Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server · Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server · Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server · Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server · and others 20
fix ↗
Not affected
6 products (10 components) — because the vulnerable code is not present in the product
Red Hat Software Collections · Red Hat JBoss Data Grid 6 · Red Hat JBoss Data Virtualization 6 · Red Hat JBoss Fuse 6 · Red Hat JBoss Operations Network 3 · and others 1
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

Apache Tomcat allowed attackers to upload and execute malicious JSP files when HTTP PUT requests were enabled. An uploaded JSP file could run arbitrary code on the server.

Technical detail

When the Default servlet's readonly parameter is set to false, allowing HTTP PUT requests, an attacker can upload a crafted JSP file to the web root. Upon subsequent HTTP GET requests to the uploaded JSP, the server executes embedded code with server privileges, enabling remote code execution.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache Tomcat
public PoCs found — 32✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/43008exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/42966githubgithub.com/cyberheartmi9/CVE-2017-12617★ 400githubgithub.com/LongWayHomie/CVE-2017-12617★ 6githubgithub.com/ygouzerh/CVE-2017-12617★ 2githubgithub.com/K3ysTr0K3R/CVE-2017-12617-EXPLOIT★ 1githubgithub.com/jptr218/tc_hack★ 1githubgithub.com/tyranteye666/tomcat-cve-2017-12617★ 1githubgithub.com/yZee00/CVE-2017-12617★ 0githubgithub.com/devcoinfet/CVE-2017-12617★ 0githubgithub.com/DevaDJ/CVE-2017-12617★ 0githubgithub.com/scirusvulgaris/CVE-2017-12617★ 0githubgithub.com/qiantu88/CVE-2017-12617★ 0vulncheckvulncheck.com/xdb/4d32b8f34452unverifiedvulncheckvulncheck.com/xdb/8fd4c4b18c5funverifiedvulncheckvulncheck.com/xdb/b858a57a9e2eunverifiedcve_referencewww.exploit-db.com/exploits/42966/unverifiedcve_referencewww.exploit-db.com/exploits/43008/unverifiedvulncheckvulncheck.com/xdb/b95c22f2d53aunverifiedvulncheckvulncheck.com/xdb/476468103ba2unverifiedvulncheckvulncheck.com/xdb/c42eddecf666unverifiedvulncheckvulncheck.com/xdb/bd768a95e919unverifiedvulncheckvulncheck.com/xdb/4659f86bc8f1unverifiedvulncheckvulncheck.com/xdb/a95e521b14feunverifiedvulncheckvulncheck.com/xdb/89ebe594235funverifiedvulncheckvulncheck.com/xdb/c733f0b8ba46unverifiedvulncheckvulncheck.com/xdb/c34ae4bbbf1eunverifiedvulncheckvulncheck.com/xdb/0cbcf731ead7unverifiedvulncheckvulncheck.com/xdb/d105c8c6f54funverifiedvulncheckvulncheck.com/xdb/6fba41ba4785unverifiedvulncheckvulncheck.com/xdb/7804de914c0cunverifiedvulncheckvulncheck.com/xdb/f5e54c16d591unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache Tomcat

In the same product, most dangerous first.

CVE-2025-24813CRITICALApache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTEPSS 99.9%KEVCVE-2017-12615HIGHCVE-2017-12615EPSS 99.7%KEVCVE-2026-34486HIGHApache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorEPSS 98.5%KEVCVE-2016-8735CRITICALCVE-2016-8735EPSS 90.3%KEVCVE-2018-11784—CVE-2018-11784EPSS 97.7%CVE-2021-33037—Incorrect Transfer-Encoding handling with HTTP/1.0EPSS 74.7%