VulnerabilityAnalyzed

CVE-2017-12617

Apache Tomcat Remote Code Execution Vulnerability

KEVHIGH 8.1EPSS 100.0%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 15 April 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

CVSS 3.1: 8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 99.99% probability · 100th percentile
CISA KEV: Listed 25 March 2022 · due 15 April 2022
Weakness: CWE-434
Affected: apache/tomcat · canonical/ubuntu linux · oracle/agile product lifecycle management · oracle/communications instant messaging server · oracle/endeca information discovery integrator · oracle/enterprise manager for mysql database · oracle/financial services analytical applications infrastructure · oracle/fmw platform · oracle/health sciences empirica inspections · oracle/hospitality guest access · oracle/instantis enterprisetrack · oracle/management pack · oracle/micros lucas · oracle/micros retail xbri loss prevention · oracle/mysql enterprise monitor · oracle/retail advanced inventory planning · oracle/retail back office · oracle/retail central office · oracle/retail convenience and fuel pos software · oracle/retail eftlink · +38 more
Source: security@apache.org

CISA notes

Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2017-12617

References

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/100954Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039552Broken Link, Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:3080Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3081Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3113Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3114Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0268Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0269Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0270Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0271Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0275Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0465Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0466Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2939Third Party Advisory
https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb%40%3Cannounce.tomcat.apache.org%3EIssue Tracking, Mailing List
https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3EMailing List, Patch
https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3EMailing List, Patch

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.