VulnerabilityAnalyzed

CVE-2017-12617

Apache Tomcat Remote Code Execution Vulnerability

KEVEXPLOIT ×2 ✓HIGH 8.1EPSS 100.0%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 15 April 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

CVSS 3.1: 8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 99.97% probability · 100th percentile
Public exploits: 2 in Exploit-DB · verified · first 9 October 2017
CISA KEV: Listed 25 March 2022 · due 15 April 2022
Weakness: CWE-434
Affected: apache/tomcat · canonical/ubuntu linux · oracle/agile product lifecycle management · oracle/communications instant messaging server · oracle/endeca information discovery integrator · oracle/enterprise manager for mysql database · oracle/financial services analytical applications infrastructure · oracle/fmw platform · oracle/health sciences empirica inspections · oracle/hospitality guest access · oracle/instantis enterprisetrack · oracle/management pack · oracle/micros lucas · oracle/micros retail xbri loss prevention · oracle/mysql enterprise monitor · oracle/retail advanced inventory planning · oracle/retail back office · oracle/retail central office · oracle/retail convenience and fuel pos software · oracle/retail eftlink · +38 more
Source: security@apache.org

EPSS trend

EPSS 100.0% since 27 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

CISA notes

Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2017-12617

Public exploits (2)

Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.

EDB-ID	Title	Type	Published	Verified
EDB-43008 source ↗	Tomcat - Remote Code Execution via JSP Upload Bypass (Metasploit)java · Metasploit	remote	17 October 2017	yes
EDB-42966 source ↗	Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (2)jsp · intx0x80	webapps	9 October 2017	yes

References

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/100954Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039552Broken Link, Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:3080Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3081Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3113Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3114Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0268Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0269Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0270Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0271Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0275Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0465Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0466Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2939Third Party Advisory
https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb%40%3Cannounce.tomcat.apache.org%3EIssue Tracking, Mailing List
https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3EMailing List, Patch

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.