NexaPulse
Subscribe
Exploited· due 2022-04-158.1highHigh

CVE-2017-12617

Apache Tomcat

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Exploitation status

  • CISA has confirmed this is being exploited in the wild. That is an observation of real attacks, not a prediction.
  • US federal civilian agencies are required to remediate it by 2022-04-15. That deadline does not bind private companies, but it is a reasonable benchmark for how urgently CISA views it.
  • A vendor advisory or patch reference has been published.

Required action

Apply updates per vendor instructions.

CISA’s wording, unedited.

What the metrics mean

  • It is reachable over a network, without needing local access.
  • For an attacker who can reach it, exploitation depends on conditions outside the attacker's control.
  • To exploit it, no account is needed.
  • Beyond that, no action by a user is required.

Scoring

CVSS
8.1 (v3.1)
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-434
Assigned by
security@apache.org

Dates

Published
2017-10-04
Last modified
2026-08-25
Added to KEV
2022-03-25
Remediation due
2022-04-15
Sources
CISA KEV, NVD

Affected products

  • Apache Tomcat7.0.0 - 7.0.82, 8.0 - 8.0.47, 8.5.0 - 8.5.23, 9.0.0 - 9.0.1
  • Canonical Ubuntu Linux12.04, 16.04, 17.10, 18.04
  • Oracle Agile Product Lifecycle Management9.3.3, 9.3.4, 9.3.5, 9.3.6
  • Oracle Communications Instant Messaging Server10.0.1
  • Oracle Endeca Information Discovery Integrator3.1.0, 3.2.0
  • Oracle Enterprise Manager For Mysql Database12.1.0.4.0
  • Oracle Financial Services Analytical Applications Infrastructure7.3.3.0.0 - 7.3.5.3.0, 8.0.0.0.0 - 8.0.9.0.0
  • Oracle Fmw Platform12.2.1.2.0, 12.2.1.3.0
  • Oracle Health Sciences Empirica Inspections1.0.1.1
  • Oracle Hospitality Guest Access4.2.0, 4.2.1
  • Oracle Instantis Enterprisetrack17.1, 17.2
  • Oracle Management Pack11.2.1.0.13

As listed in the NVD configuration data. Not a statement about your estate.

References