UpHeron
All vulnerabilities

Servers and applications

CVE-2017-12617

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 25 Mar 2022.

Severity
High 8.1
Published
4 Oct 2017
Last changed
25 Aug 2026
Added to UpHeron
21 Oct 2026
Fixed in
7.0.82, 8.0.47, 8.5.23, 9.0.1
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • From 7.0.0 before 7.0.82
  • From 8.0 before 8.0.47
  • From 8.5.0 before 8.5.23
  • From 9.0.0 before 9.0.1

Known exploited

CISA name
Apache Tomcat Remote Code Execution Vulnerability
Required action
Apply updates per vendor instructions.
Due for US agencies
15 Apr 2022
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-12617
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-12617