apache tomcat CVE-2017-12617 vulnerability in Apache and Other Products
Published on October 4, 2017

product logo product logo product logo product logo product logo product logo
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

NVD

Known Exploited Vulnerability

This Apache Tomcat Remote Code Execution Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

The following remediation steps are recommended / required by April 15, 2022: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2017-12617 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. It has an exploitability score of 2.2 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

What is an Unrestricted File Upload Vulnerability?

The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

CVE-2017-12617 has been classified to as an Unrestricted File Upload vulnerability or weakness.


Products Associated with CVE-2017-12617

You can be notified by stack.watch whenever vulnerabilities like CVE-2017-12617 are published in these products:

Apache Tomcat
 
Canonical Ubuntu Linux
 
Oracle Transportation Management
 
Oracle Retail Xstore Point Of Service
 
Oracle Webcenter Sites
 
Oracle Retail Invoice Matching
 
Oracle Hospitality Guest Access
 
Oracle Retail Central Office
 
Oracle Retail Returns Management
 
Oracle Retail Point Of Service
 
Oracle Retail Back Office
 
Oracle Endeca Information Discovery Integrator
 
Oracle Retail Order Broker
 
Oracle Instantis Enterprisetrack
 
Oracle Agile Plm
 
Oracle Micros Lucas
 
Oracle Communications Instant Messaging Server
 
Oracle Workload Manager
 
Oracle Retail Advanced Inventory Planning
 
Oracle Retail Price Management
 
Oracle Retail Store Inventory Management
 
Oracle Fmw Platform
 
Oracle Retail Convenience Fuel Pos Software
 
Oracle Micros Retail Xbri Loss Prevention
 
Oracle Mysql Enterprise Monitor
 
Oracle Health Sciences Empirica Inspections
 
Oracle Tuxedo System Applications Monitor
 
Oracle Retail Order Management System
 
Oracle Retail Insights
 
Oracle Retail Eftlink
 
Oracle Management Pack
 
Oracle Financial Services Analytical Applications Infrastructure
 
Oracle Enterprise Manager Mysql Database
 
Debian Linux
 
NetApp Oncommand Balance
 
NetApp Snapcenter
 
NetApp Oncommand Workflow Automation
 
NetApp Oncommand Insight
 
NetApp Active Iq Unified Manager
 
NetApp Oncommand Shift
 
NetApp Element
 
Red Hat Enterprise Linux Desktop
 
Red Hat Enterprise Linux Workstation
 
Red Hat Enterprise Linux Server
 
Red Hat Jboss Enterprise Application Platform
 
Red Hat Enterprise Linux Power Little Endian
 
Red Hat Jboss Enterprise Web Server
 
Red Hat Enterprise Linux Server Aus
 
Red Hat Enterprise Linux Server Tus
 
Red Hat Enterprise Linux Eus
 
Red Hat Enterprise Linux Power Big Endian Eus
 
Red Hat Fuse
 
Red Hat Enterprise Linux Power Big Endian
 
Red Hat Enterprise Linux Ibm Z Systems
 
Red Hat Enterprise Linux Eus Compute Node
 
Red Hat Enterprise Linux Power Little Endian Eus
 
Red Hat Enterprise Linux Ibm Z Systems Eus
 
Red Hat Jboss Enterprise Web Server Text Only Advisories
 

What versions are vulnerable to CVE-2017-12617?