What’s Vulnerable › Vulnerabilities

CVE-2017-12615: Apache Tomcat on Windows Remote Code Execution Vulnerability

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-03-25
• EPSS: 99.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-09-19 · updated 2026-08-06
• Weakness: CWE-434

Description

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Affected products

• Apache Tomcat: from 7.0.0 through 7.0.79
• NetApp 7-Mode Transition Tool: all versions
• NetApp Oncommand Balance: all versions
• NetApp Oncommand Shift: all versions
• RedHat Enterprise Linux Desktop: 6.0, 7.0
• RedHat Enterprise Linux Eus: 7.4, 7.5, 7.6, 7.7
• RedHat Enterprise Linux Eus Compute Node: 7.4, 7.5, 7.6, 7.7
• RedHat Enterprise Linux For Ibm Z Systems: 7.0_s390x
• RedHat Enterprise Linux For Ibm Z Systems Eus: 7.4_s390x, 7.5_s390x, 7.6_s390x, 7.7_s390x
• RedHat Enterprise Linux For Power Big Endian: 7.0_ppc64
• RedHat Enterprise Linux For Power Big Endian Eus: 7.4_ppc64, 7.5_ppc64, 7.6_ppc64, 7.7_ppc64
• RedHat Enterprise Linux For Power Little Endian: 7.0_ppc64le
• RedHat Enterprise Linux For Power Little Endian Eus: 7.4_ppc64le, 7.5_ppc64le, 7.6_ppc64le, 7.7_ppc64le
• RedHat Enterprise Linux For Scientific Computing: 7.0
• RedHat Enterprise Linux Server: 6.0, 7.0
• RedHat Enterprise Linux Server Aus: 7.4, 7.6, 7.7
• RedHat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions: 7.4_ppc64le, 7.6_ppc64le, 7.7_ppc64le, 9.2_ppc64le
• RedHat Enterprise Linux Server Tus: 7.4, 7.6, 7.7
• RedHat Enterprise Linux Server Update Services For Sap Solutions: 7.4, 7.6, 7.7
• RedHat Enterprise Linux Workstation: 6.0, 7.0
• Red Hat JBoss Enterprise Web Server: 2.0.0, 3.0.0
• RedHat Jboss Enterprise Web Server Text-Only Advisories: all versions

References

• http://breaktoprotect.blogspot.com/2017/09/the-case-of-cve-2017-12615-tomcat-7-put.html
• http://www.securityfocus.com/bid/100901
• http://www.securitytracker.com/id/1039392
• https://access.redhat.com/errata/RHSA-2017:3080
• https://access.redhat.com/errata/RHSA-2017:3081
• https://access.redhat.com/errata/RHSA-2017:3113
• https://access.redhat.com/errata/RHSA-2017:3114
• https://access.redhat.com/errata/RHSA-2018:0465
• https://access.redhat.com/errata/RHSA-2018:0466
• https://github.com/breaktoprotect/CVE-2017-12615
• https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E

Get alerted when CVE-2017-12615 or the next vulnerability affects your stack