CVE-2017-12617: Apache Tomcat Remote Code Execution Vulnerability

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: yes — in CISA KEV since 2022-03-25
EPSS: 100.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-10-04 · updated 2026-08-25
Weakness: CWE-434

Description

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Affected products

Apache Tomcat: from 7.0.0 before 7.0.82; from 8.0 before 8.0.47; from 8.5.0 before 8.5.23; from 9.0.0 before 9.0.1 — fixed in 7.0.82, 8.0.47, 8.5.23, 9.0.1
Canonical Ubuntu Linux: 12.04, 16.04, 17.10, 18.04
Debian Linux: 7.0
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 7.3; from 9.5
NetApp Element: all versions
NetApp Oncommand Balance: all versions
OnCommand Insight: all versions
NetApp Oncommand Shift: all versions
NetApp OnCommand Workflow Automation: all versions
NetApp SnapCenter: all versions
Oracle Corporation Oracle Agile PLM: 9.3.3, 9.3.4, 9.3.5, 9.3.6
Oracle Communications Instant Messaging Server: 10.0.1
Oracle Corporation Endeca Information Discovery Integrator: 3.1.0, 3.2.0
Oracle Enterprise Manager For Mysql Database: 12.1.0.4.0
Oracle Corporation Financial Services Analytical Applications Infrastructure: from 7.3.3.0.0 through 7.3.5.3.0; from 8.0.0.0.0 through 8.0.9.0.0
Oracle Fmw Platform: 12.2.1.2.0, 12.2.1.3.0
Oracle Health Sciences Empirica Inspections: 1.0.1.1
Oracle Corporation Hospitality Guest Access: 4.2.0, 4.2.1
Oracle Instantis Enterprisetrack: 17.1, 17.2
Oracle Management Pack: 11.2.1.0.13
Oracle Corporation MICROS Lucas: 2.9.5
Oracle Micros Retail Xbri Loss Prevention: 10.0.1, 10.5.0, 10.6.0, 10.7.0, 10.8.0, 10.8.1
Oracle Corporation MySQL Enterprise Monitor: through 3.3.6.3293; from 3.4.0 through 3.4.4.4226; from 4.0.0 through 4.0.0.5135
Oracle Retail Advanced Inventory Planning: 13.2, 13.4, 14.1, 15.0
Oracle Corporation Retail Back Office: 14.0.4, 14.1.3
Oracle Corporation Retail Central Office: 14.0.4, 14.1.3
Oracle Retail Convenience And Fuel Pos Software: 2.1.132
Oracle Corporation Oracle Retail EFTLink: 1.1.124, 15.0.1, 16.0.2
Oracle Retail Insights: 14.0, 14.1, 15.0, 16.0
Oracle Corporation Retail Invoice Matching: 12.0, 13.0, 13.1, 13.2, 14.0, 14.1 (+2)

How to fix

Upgrade to a fixed version: Apache Tomcat 7.0.82, 8.0.47, 8.5.23, 9.0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-12617 or the next vulnerability affects your stack