CVE-2017-12617High· 8.1▾ Abyssal⚠ Exploited in the wildPoC availableWhen running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possib…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 44.6 · likelihood 20 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 4 sources. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Apr 15, 2022
Last analysed / modified upstream
100%
Exploit-DB · 10 GitHub repos · Metasploit ×1 · Nuclei ×1 (last check)
Added to the CISA catalog on Mar 25, 2022. Federal remediation due Apr 15, 2022. View catalog ↗
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
tomcat >= 7.0.0, < 7.0.82tomcat >= 8.0, < 8.0.47tomcat >= 8.5.0, < 8.5.23tomcat >= 9.0.0, < 9.0.1ubuntu_linux = 12.04ubuntu_linux = 16.04ubuntu_linux = 17.10ubuntu_linux = 18.04agile_product_lifecycle_management = 9.3.3agile_product_lifecycle_management = 9.3.4agile_product_lifecycle_management = 9.3.5agile_product_lifecycle_management = 9.3.6communications_instant_messaging_server = 10.0.1endeca_information_discovery_integrator = 3.1.0endeca_information_discovery_integrator = 3.2.0enterprise_manager_for_mysql_database = 12.1.0.4.0financial_services_analytical_applications_infrastructure >= 7.3.3.0.0, <= 7.3.5.3.0financial_services_analytical_applications_infrastructure >= 8.0.0.0.0, <= 8.0.9.0.0fmw_platform = 12.2.1.2.0fmw_platform = 12.2.1.3.0health_sciences_empirica_inspections = 1.0.1.1hospitality_guest_access = 4.2.0hospitality_guest_access = 4.2.1instantis_enterprisetrack = 17.1instantis_enterprisetrack = 17.2management_pack = 11.2.1.0.13micros_lucas = 2.9.5micros_retail_xbri_loss_prevention = 10.0.1micros_retail_xbri_loss_prevention = 10.5.0micros_retail_xbri_loss_prevention = 10.6.0micros_retail_xbri_loss_prevention = 10.7.0micros_retail_xbri_loss_prevention = 10.8.0micros_retail_xbri_loss_prevention = 10.8.1mysql_enterprise_monitor <= 3.3.6.3293mysql_enterprise_monitor >= 3.4.0, <= 3.4.4.4226mysql_enterprise_monitor >= 4.0.0, <= 4.0.0.5135retail_advanced_inventory_planning = 13.2retail_advanced_inventory_planning = 13.4retail_advanced_inventory_planning = 14.1retail_advanced_inventory_planning = 15.0retail_back_office = 14.0.4retail_back_office = 14.1.3retail_central_office = 14.0.4retail_central_office = 14.1.3retail_convenience_and_fuel_pos_software = 2.1.132retail_eftlink = 1.1.124retail_eftlink = 15.0.1retail_eftlink = 16.0.2retail_insights = 14.0retail_insights = 14.1retail_insights = 15.0retail_insights = 16.0retail_invoice_matching = 12.0retail_invoice_matching = 13.0retail_invoice_matching = 13.1retail_invoice_matching = 13.2retail_invoice_matching = 14.0retail_invoice_matching = 14.1retail_invoice_matching = 15.0retail_invoice_matching = 16.0retail_order_broker = 5.0retail_order_broker = 5.1retail_order_broker = 5.2retail_order_broker = 15.0retail_order_broker = 16.0retail_order_management_system = 4.0retail_order_management_system = 4.5retail_order_management_system = 4.7retail_order_management_system = 5.0retail_point-of-service = 14.0.4retail_point-of-service = 14.1.3retail_price_management = 12.0retail_price_management = 13.0retail_price_management = 13.1retail_price_management = 13.2retail_price_management = 14.0retail_price_management = 14.1retail_price_management = 15.0retail_price_management = 16.0retail_returns_management = 2.3.8retail_returns_management = 2.4.9retail_returns_management = 14.0.4retail_returns_management = 14.1.3retail_store_inventory_management = 12.0.12retail_store_inventory_management = 13.0.7retail_store_inventory_management = 13.1.9retail_store_inventory_management = 13.2.9retail_store_inventory_management = 14.0.4retail_store_inventory_management = 14.1.3retail_store_inventory_management = 15.0.2retail_store_inventory_management = 16.0.1retail_xstore_point_of_service = 6.0.11retail_xstore_point_of_service = 7.0.6retail_xstore_point_of_service = 7.1.6retail_xstore_point_of_service = 15.0.1transportation_management = 6.3.1transportation_management = 6.3.2transportation_management = 6.3.3transportation_management = 6.3.4transportation_management = 6.3.5Upgrade past the affected range:
tomcat 9.0.1Connected by shared product, vendor, weakness, or advisory.
CVE-2017-12615High· 8.1When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g
CVE-2016-8735Critical· 9.8Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports
CVE-2018-11784Medium· 4.3When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g
CVE-2018-1304Medium· 5.9The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constr…
CVE-2018-1305Medium· 6.5Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded
CVE-2016-0714High· 8.8The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityMa…