CVE-2017-12617
published 2017-10-04CVE-2017-12617: When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the…
PriorityP193high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-04-15
Exploited in the wild
EPSS
99.99%
100.0th percentile
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Affected
155 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | >= 7.0.0 < 7.0.82 | 7.0.82 |
| apache | tomcat | >= 8.0 < 8.0.47 | 8.0.47 |
| apache | tomcat | >= 8.5.0 < 8.5.23 | 8.5.23 |
| apache | tomcat | >= 9.0.0 < 9.0.1 | 9.0.1 |
| apache_software_foundation | apache_tomcat | — | — |
| apache_software_foundation | apache_tomcat | — | — |
| apache_software_foundation | apache_tomcat | — | — |
| apache_software_foundation | apache_tomcat | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| netapp | active_iq_unified_manager | >= 7.3 | — |
| netapp | active_iq_unified_manager | >= 9.5 | — |
| oracle | agile_product_lifecycle_management | — | — |
| oracle | agile_product_lifecycle_management | — | — |
| oracle | agile_product_lifecycle_management | — | — |
| oracle | agile_product_lifecycle_management | — | — |
| oracle | communications_instant_messaging_server | — | — |
| oracle | endeca_information_discovery_integrator | — | — |
| oracle | endeca_information_discovery_integrator | — | — |
| oracle | enterprise_manager_for_mysql_database | — | — |
| oracle | financial_services_analytical_applications_infrastructure | 7.3.3.0.0 – 7.3.5.3.0 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP PUT requests targeting paths ending with '.jsp/' (trailing slash bypass) — the exploit uploads a JSP webshell via PUT to a path like /<name>.jsp/ and then executes it via GET to /<name>.jsp ↗
- →Alert on HTTP PUT requests with a URI ending in '.jsp/' (trailing slash) followed by a GET to the same path without the trailing slash — this two-step pattern is the canonical exploit sequence for CVE-2017-12617 ↗
- →A successful upload returns HTTP 201; monitor for HTTP 201 responses to PUT requests targeting JSP paths on Tomcat servers ↗
- →Shodan/FOFA queries can identify exposed Tomcat instances: search for html:"Apache Tomcat", http.title:"apache tomcat", or body="apache tomcat" ↗
- ·Vulnerability only exists when HTTP PUT is enabled by setting the 'readonly' initialisation parameter of the Default servlet to false — the default configuration is NOT vulnerable ↗
- ·Red Hat notes the default Tomcat context is readonly and therefore not affected; only explicitly misconfigured contexts with readonly=false are vulnerable ↗
- ·Mitigation (short of patching) is to ensure readonly=true for DefaultServlet/WebDAV servlet and to block HTTP methods that permit resource modification for untrusted users ↗
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.1HIGH
vulncheck8.1HIGH
cisa8.1HIGH
vendor_apache8.1HIGH
vendor_redhat8.1HIGH
vendor_ubuntu7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Oracle Financial Services Analytical Applications Infrastructure unrestricted upload (EDB-43008 / Nessus ID 103697)
vuldb·2026-08-25·CVSS 8.1
CVE-2017-12617 [HIGH] Oracle Financial Services Analytical Applications Infrastructure unrestricted upload (EDB-43008 / Nessus ID 103697)
A vulnerability, which was classified as critical, has been found in Oracle Financial Services Analytical Applications Infrastructure 7.3.x/8.0.x. This affects an unknown part of the component Infrastructure. This manipulation causes unrestricted upload.
This vulnerability is registered as CVE-2017-12617. Remote exploitation of the attack is possible. Furthermore, an exploit is available.
It is advisable to upgrade the affected component.
VulDB
Oracle Tuxedo System/Applications Monitor 12.1.3.0.0 tsam-General unrestricted upload (EDB-43008 / Nessus ID 104257)
vuldb·2026-08-25·CVSS 8.1
CVE-2017-12617 [HIGH] Oracle Tuxedo System/Applications Monitor 12.1.3.0.0 tsam-General unrestricted upload (EDB-43008 / Nessus ID 104257)
A vulnerability was found in Oracle Tuxedo System and Applications Monitor 12.1.3.0.0. It has been classified as critical. The affected element is an unknown function of the component tsam-General. The manipulation leads to unrestricted upload.
This vulnerability is traded as CVE-2017-12617. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
Upgrading the affected component is recommended.
VulDB
Oracle Agile PLM 9.3.3/9.3.4/9.3.5/9.3.6 Apache Tomcat unrestricted upload (EDB-43008 / Nessus ID 104257)
vuldb·2026-08-25·CVSS 8.1
CVE-2017-12617 [HIGH] Oracle Agile PLM 9.3.3/9.3.4/9.3.5/9.3.6 Apache Tomcat unrestricted upload (EDB-43008 / Nessus ID 104257)
A vulnerability was found in Oracle Agile PLM 9.3.3/9.3.4/9.3.5/9.3.6. It has been declared as critical. This issue affects some unknown processing of the component Apache Tomcat. Such manipulation leads to unrestricted upload.
This vulnerability is referenced as CVE-2017-12617. It is possible to launch the attack remotely. Furthermore, an exploit is available.
It is recommended to upgrade the affected component.
VulDB
Oracle Management Pack for GoldenGate 11.2.1.0.13 Monitor unrestricted upload (EDB-43008 / Nessus ID 103697)
vuldb·2026-08-25·CVSS 8.1
CVE-2017-12617 [HIGH] Oracle Management Pack for GoldenGate 11.2.1.0.13 Monitor unrestricted upload (EDB-43008 / Nessus ID 103697)
A vulnerability was found in Oracle Management Pack for GoldenGate 11.2.1.0.13. It has been rated as critical. The affected element is an unknown function of the component Monitor. This manipulation causes unrestricted upload.
This vulnerability appears as CVE-2017-12617. The attack may be initiated remotely. In addition, an exploit is available.
Upgrading the affected component is advised.
VulDB
Oracle WebCenter Sites 11.1.1.8.0 Advanced UI unrestricted upload (EDB-43008 / Nessus ID 103697)
vuldb·2026-08-25·CVSS 8.1
CVE-2017-12617 [HIGH] Oracle WebCenter Sites 11.1.1.8.0 Advanced UI unrestricted upload (EDB-43008 / Nessus ID 103697)
A vulnerability identified as critical has been detected in Oracle WebCenter Sites 11.1.1.8.0. This affects an unknown function of the component Advanced UI. Performing a manipulation results in unrestricted upload.
This vulnerability is known as CVE-2017-12617. Remote exploitation of the attack is possible. Furthermore, an exploit is available.
You should upgrade the affected component.
VulDB
Oracle MySQL Enterprise Monitor up to 3.3.6.3293/3.4.4.4226/4.0.0.5135 Monitoring unrestricted upload (EDB-43008 / Nessus ID 104257)
vuldb·2026-08-25·CVSS 8.1
CVE-2017-12617 [HIGH] Oracle MySQL Enterprise Monitor up to 3.3.6.3293/3.4.4.4226/4.0.0.5135 Monitoring unrestricted upload (EDB-43008 / Nessus ID 104257)
A vulnerability has been found in Oracle MySQL Enterprise Monitor up to 3.3.6.3293/3.4.4.4226/4.0.0.5135 and classified as critical. This affects an unknown function of the component Monitoring. This manipulation causes unrestricted upload.
This vulnerability is tracked as CVE-2017-12617. The attack is possible to be carried out remotely. Moreover, an exploit is present.
The affected component should be upgraded.
VulDB
Oracle Database 12.2.0.1 Apache Tomcat unrestricted upload (EDB-43008 / Nessus ID 104257)
vuldb·2026-08-25·CVSS 8.1
CVE-2017-12617 [HIGH] Oracle Database 12.2.0.1 Apache Tomcat unrestricted upload (EDB-43008 / Nessus ID 104257)
A vulnerability was found in Oracle Database 12.2.0.1. It has been classified as critical. This affects an unknown part of the component Apache Tomcat. This manipulation causes unrestricted upload.
The identification of this vulnerability is CVE-2017-12617. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
Upgrading the affected component is recommended.
VulDB
Oracle Instantis EnterpriseTrack 17.1/17.2 Web Server unrestricted upload (EDB-43008 / Nessus ID 103697)
vuldb·2026-08-25·CVSS 8.1
CVE-2017-12617 [HIGH] Oracle Instantis EnterpriseTrack 17.1/17.2 Web Server unrestricted upload (EDB-43008 / Nessus ID 103697)
A vulnerability categorized as critical has been discovered in Oracle Instantis EnterpriseTrack 17.1/17.2. Affected by this vulnerability is an unknown functionality of the component Web Server. Such manipulation leads to unrestricted upload.
This vulnerability is referenced as CVE-2017-12617. It is possible to launch the attack remotely. Furthermore, an exploit is available.
It is advisable to upgrade the affected component.
VulDB
Oracle FMW Platform 12.2.1.2.0/12.2.1.3.0 Common Components unrestricted upload (EDB-43008 / Nessus ID 103697)
vuldb·2026-08-25·CVSS 8.1
CVE-2017-12617 [HIGH] Oracle FMW Platform 12.2.1.2.0/12.2.1.3.0 Common Components unrestricted upload (EDB-43008 / Nessus ID 103697)
A vulnerability was found in Oracle FMW Platform 12.2.1.2.0/12.2.1.3.0. It has been declared as critical. Affected by this issue is some unknown functionality of the component Common Components. Such manipulation leads to unrestricted upload.
This vulnerability is traded as CVE-2017-12617. The attack may be launched remotely. Furthermore, there is an exploit available.
It is recommended to upgrade the affected component.
VulDB
Oracle Retail Order Broker 5.2/15.0 Upgrade Install unrestricted upload (EDB-43008 / Nessus ID 103697)
vuldb·2026-08-25·CVSS 8.1
CVE-2017-12617 [HIGH] Oracle Retail Order Broker 5.2/15.0 Upgrade Install unrestricted upload (EDB-43008 / Nessus ID 103697)
A vulnerability was found in Oracle Retail Order Broker 5.2/15.0. It has been classified as critical. The affected element is an unknown function of the component Upgrade Install. Performing a manipulation results in unrestricted upload.
This vulnerability was named CVE-2017-12617. The attack may be initiated remotely. In addition, an exploit is available.
Upgrading the affected component is recommended.
VulDB
Apache Tomcat up to 7.0.81/8.0.46/8.5.22/9.0.0 JSP File unrestricted upload (RHSA-2017:3080 / EDB-43008)
vuldb·2026-08-25·CVSS 8.1
CVE-2017-12617 [HIGH] Apache Tomcat up to 7.0.81/8.0.46/8.5.22/9.0.0 JSP File unrestricted upload (RHSA-2017:3080 / EDB-43008)
A vulnerability, which was classified as critical, was found in Apache Tomcat up to 7.0.81/8.0.46/8.5.22/9.0.0. The affected element is an unknown function of the component JSP File Handler. Executing a manipulation can lead to unrestricted upload.
This vulnerability is registered as CVE-2017-12617. It is possible to launch the attack remotely. Furthermore, an exploit is available.
You should upgrade the affected component.
VulDB
Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat unrestricted upload (EDB-43008 / Nessus ID 104257)
vuldb·2026-08-25·CVSS 8.1
CVE-2017-12617 [HIGH] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat unrestricted upload (EDB-43008 / Nessus ID 104257)
A vulnerability, which was classified as critical, was found in Oracle Hospitality Guest Access 4.2.0/4.2.1. This impacts an unknown function of the component Apache Tomcat. The manipulation results in unrestricted upload.
This vulnerability is cataloged as CVE-2017-12617. The attack may be launched remotely. Furthermore, there is an exploit available.
You should upgrade the affected component.
VulDB
Oracle Endeca Information Discovery Integrator 3.1.0/3.2.0 Apache Tomcat unrestricted upload (EDB-43008 / Nessus ID 104257)
vuldb·2026-08-25·CVSS 8.1
CVE-2017-12617 [HIGH] Oracle Endeca Information Discovery Integrator 3.1.0/3.2.0 Apache Tomcat unrestricted upload (EDB-43008 / Nessus ID 104257)
A vulnerability was found in Oracle Endeca Information Discovery Integrator 3.1.0/3.2.0 and classified as critical. Impacted is an unknown function of the component Apache Tomcat. Executing a manipulation can lead to unrestricted upload.
This vulnerability appears as CVE-2017-12617. The attack may be performed from remote. In addition, an exploit is available.
It is suggested to upgrade the affected component.
VulDB
Oracle Transportation Management up to 6.3.7 Install unrestricted upload (EDB-43008 / Nessus ID 104257)
vuldb·2026-08-25·CVSS 8.1
CVE-2017-12617 [HIGH] Oracle Transportation Management up to 6.3.7 Install unrestricted upload (EDB-43008 / Nessus ID 104257)
A vulnerability was found in Oracle Transportation Management up to 6.3.7. It has been rated as critical. Impacted is an unknown function of the component Install. Performing a manipulation results in unrestricted upload.
This vulnerability is identified as CVE-2017-12617. The attack can be initiated remotely. Additionally, an exploit exists.
Upgrading the affected component is advised.
VulDB
Oracle MICROS Retail XBRi Loss Prevention up to 10.8.1 Apache Tomcat unrestricted upload (EDB-43008 / Nessus ID 104257)
vuldb·2026-08-25·CVSS 8.1
CVE-2017-12617 [HIGH] Oracle MICROS Retail XBRi Loss Prevention up to 10.8.1 Apache Tomcat unrestricted upload (EDB-43008 / Nessus ID 104257)
A vulnerability identified as critical has been detected in Oracle MICROS Retail XBRi Loss Prevention up to 10.8.1. Affected by this issue is some unknown functionality of the component Apache Tomcat. This manipulation causes unrestricted upload.
This vulnerability is registered as CVE-2017-12617. Remote exploitation of the attack is possible. Furthermore, an exploit is available.
You should upgrade the affected component.
VulDB
Oracle Retail Convenience/Fuel POS Software 2.1.132 OPT Server unrestricted upload (EDB-43008 / Nessus ID 103697)
vuldb·2026-08-25·CVSS 8.1
CVE-2017-12617 [HIGH] Oracle Retail Convenience/Fuel POS Software 2.1.132 OPT Server unrestricted upload (EDB-43008 / Nessus ID 103697)
A vulnerability categorized as critical has been discovered in Oracle Retail Convenience and Fuel POS Software 2.1.132. Affected by this vulnerability is an unknown functionality of the component OPT Server. The manipulation results in unrestricted upload.
This vulnerability is identified as CVE-2017-12617. The attack can be executed remotely. Additionally, an exploit exists.
It is advisable to upgrade the affected component.
VulDB
Oracle Health Sciences Empirica Inspections 1.0.1.1 Apache Tomcat unrestricted upload (EDB-43008 / Nessus ID 104257)
vuldb·2026-08-25·CVSS 8.1
CVE-2017-12617 [HIGH] Oracle Health Sciences Empirica Inspections 1.0.1.1 Apache Tomcat unrestricted upload (EDB-43008 / Nessus ID 104257)
A vulnerability identified as problematic has been detected in Oracle Health Sciences Empirica Inspections 1.0.1.1. This affects an unknown part of the component Apache Tomcat. The manipulation leads to unrestricted upload.
This vulnerability is uniquely identified as CVE-2017-12617. The attack is possible to be carried out remotely. Moreover, an exploit is present.
You should upgrade the affected component.
OSV
Unrestricted Upload of File with Dangerous Type Apache Tomcat
osv·2022-05-14
CVE-2017-12617 [HIGH] Unrestricted Upload of File with Dangerous Type Apache Tomcat
Unrestricted Upload of File with Dangerous Type Apache Tomcat
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
GHSA
Unrestricted Upload of File with Dangerous Type Apache Tomcat
ghsa·2022-05-14
CVE-2017-12617 [HIGH] CWE-434 Unrestricted Upload of File with Dangerous Type Apache Tomcat
Unrestricted Upload of File with Dangerous Type Apache Tomcat
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
OSV
tomcat7, tomcat8 vulnerabilities
osv·2018-05-30·CVSS 7.5
CVE-2017-12616 [HIGH] tomcat7, tomcat8 vulnerabilities
tomcat7, tomcat8 vulnerabilities
It was discovered that Tomcat incorrectly handled being configured with
HTTP PUTs enabled. A remote attacker could use this issue to upload a JSP
file to the server and execute arbitrary code. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2017-12616,
CVE-2017-12617)
It was discovered that Tomcat contained incorrect documentation regarding
description of the search algorithm used by the CGI Servlet to identify
which script to execute. This issue only affected Ubuntu 17.10.
(CVE-2017-15706)
It was discovered that Tomcat incorrectly handled en empty string URL
pattern in security constraint definitions. A remote attacker could
possibly use this issue to gain access to web application resources,
contrary to expectations.
OSV
CVE-2017-12617: When running Apache Tomcat versions 9
osv·2017-10-03·CVSS 8.1
CVE-2017-12617 [HIGH] CVE-2017-12617: When running Apache Tomcat versions 9
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
VulnCheck
Apache Tomcat Remote Code Execution Vulnerability
vulncheck·2017·CVSS 8.1
CVE-2017-12617 [HIGH] CWE-434 Apache Tomcat Remote Code Execution Vulnerability
Apache Tomcat Remote Code Execution Vulnerability
When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Affected: Apache Tomcat
Required Action: Apply updates per vendor instructions.
Exploitation References: https://blog.talosintelligence.com/2019/04/seaturtle.html; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://info.greynoise.io/hubfs/resources/GreyNoise-How-Resurgent-Vulnerabilities-Jeopardize-Organizational-Security-Report.pdf; https://www.greynoise.io/blog/coordinated-cloud-based-scanning-operation-targets-75-known-exposure-points; https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=
Ubuntu
tomcat7 vulnerabilities
vendor_ubuntu·2025-02-21
CVE-2017-12616 tomcat7 vulnerabilities
Title: tomcat7 vulnerabilities
Summary: tomcat7 could be made to execute arbitrary code.
It was discovered that Tomcat incorrectly handled being configured with
HTTP PUTs enabled. A remote attacker could use this issue to upload a JSP
file to the server and execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
CISA
Apache Tomcat Remote Code Execution Vulnerability
cisa·2022-03-25·CVSS 8.1
CVE-2017-12617 [HIGH] CWE-434 Apache Tomcat Remote Code Execution Vulnerability
Vulnerability: Apache Tomcat Remote Code Execution Vulnerability
Affected: Apache Tomcat
When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2017-12617
Remediation Due Date: 2022-04-15
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2018-05-30·CVSS 7.5
CVE-2017-12616 [HIGH] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
It was discovered that Tomcat incorrectly handled being configured with
HTTP PUTs enabled. A remote attacker could use this issue to upload a JSP
file to the server and execute arbitrary code. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2017-12616,
CVE-2017-12617)
It was discovered that Tomcat contained incorrect documentation regarding
description of the search algorithm used by the CGI Servlet to identify
which script to execute. This issue only affected Ubuntu 17.10.
(CVE-2017-15706)
It was discovered that Tomcat incorrectly handled en empty string URL
pattern in security constraint definitions. A remote attacker could
possibly use this issue to gain access to
Red Hat
tomcat: Remote Code Execution bypass for CVE-2017-12615
vendor_redhat·2017-09-21·CVSS 8.1
CVE-2017-12617 [HIGH] CWE-20 tomcat: Remote Code Execution bypass for CVE-2017-12615
tomcat: Remote Code Execution bypass for CVE-2017-12615
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution.
Statement: This flaw affects Tomcat on Red Hat Enterprise Linux only when a specific context is configured with readonly=f
Apache
Apache tomcat: CVE-2017-12617
vendor_apache·CVSS 8.1
CVE-2017-12617 [HIGH] Apache tomcat: CVE-2017-12617
Apache tomcat: CVE-2017-12617
When running with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. This was fixed in revision 1809921 . This issue was first reported publicly followed by multiple reports to the Apache Tomcat Security Team on 20 September 2017. Affects: 8.0.0.RC1 to 8.0.46 1 October 2017 Fixed in Apache Tomcat 8.5.23 Important: Remote Code Execution
Suricata
ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt
suricata·2017-10-05·CVSS 8.1
CVE-2017-12617 [HIGH] ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt
ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt
Rule: alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt"; flow:established,to_server; http.method; content:"DELETE"; http.uri; content:".jsp/"; nocase; fast_pattern; pcre:"/\.jsp\/[^\x2f]*$/i"; reference:cve,2017-12617; reference:cve,2017-12615; classtype:web-application-attack; sid:2024811; rev:7; metadata:affected_product Apache_Tomcat, attack_target Web_Server, created_at 2017_10_05, cve CVE_2017_12617, deployment Datacenter, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2024_03_07;)
Suricata
ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt
suricata·2017-10-05·CVSS 8.1
CVE-2017-12617 [HIGH] ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt
ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt
Rule: alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:".jsp/"; nocase; fast_pattern; pcre:"/\.jsp\/[^\x2f]*$/i"; reference:cve,2017-12617; reference:cve,2017-12615; classtype:web-application-attack; sid:2024808; rev:7; metadata:affected_product Apache_Tomcat, attack_target Web_Server, created_at 2017_10_05, cve CVE_2017_12617, deployment Datacenter, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2024_03_07;)
Suricata
ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt
suricata·2017-10-05·CVSS 8.1
CVE-2017-12617 [HIGH] ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt
ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt
Rule: alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt"; flow:established,to_server; http.method; content:"DELETE"; http.uri; content:".shtml/"; nocase; fast_pattern; pcre:"/\.shtml\/[^\x2f]*$/i"; reference:cve,2017-12617; reference:cve,2017-12615; classtype:web-application-attack; sid:2024813; rev:7; metadata:affected_product Apache_Tomcat, attack_target Web_Server, created_at 2017_10_05, cve CVE_2017_12617, deployment Datacenter, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2024_03_07;)
Suricata
ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt
suricata·2017-10-05·CVSS 8.1
CVE-2017-12617 [HIGH] ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt
ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt
Rule: alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:".shtml/"; nocase; fast_pattern; pcre:"/\.shtml\/[^\x2f]*$/i"; reference:cve,2017-12617; reference:cve,2017-12615; classtype:web-application-attack; sid:2024810; rev:7; metadata:affected_product Apache_Tomcat, attack_target Web_Server, created_at 2017_10_05, cve CVE_2017_12617, deployment Datacenter, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2024_03_07;)
Suricata
ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt
suricata·2017-10-05·CVSS 8.1
CVE-2017-12617 [HIGH] ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt
ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt
Rule: alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt"; flow:established,to_server; http.method; content:"DELETE"; http.uri; content:".jspx/"; nocase; fast_pattern; pcre:"/\.jspx\/[^\x2f]*$/i"; reference:cve,2017-12617; reference:cve,2017-12615; classtype:web-application-attack; sid:2024812; rev:7; metadata:affected_product Apache_Tomcat, attack_target Web_Server, created_at 2017_10_05, cve CVE_2017_12617, deployment Datacenter, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2024_03_07;)
Suricata
ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt
suricata·2017-10-05·CVSS 8.1
CVE-2017-12617 [HIGH] ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt
ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt
Rule: alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Apache Tomcat Possible CVE-2017-12617 JSP Upload Bypass Attempt"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:".jspx/"; nocase; fast_pattern; pcre:"/\.jspx\/[^\x2f]*$/i"; reference:cve,2017-12617; reference:cve,2017-12615; classtype:web-application-attack; sid:2024809; rev:7; metadata:affected_product Apache_Tomcat, attack_target Web_Server, created_at 2017_10_05, cve CVE_2017_12617, deployment Datacenter, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2024_03_07;)
Exploit-DB
Tomcat - Remote Code Execution via JSP Upload Bypass (Metasploit)
exploitdb·2017-10-17·CVSS 8.1
CVE-2017-12617 [HIGH] Tomcat - Remote Code Execution via JSP Upload Bypass (Metasploit)
Tomcat - Remote Code Execution via JSP Upload Bypass (Metasploit)
---
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Tomcat RCE via JSP Upload Bypass',
'Description' => %q{
This module uploads a jsp payload and executes it.
},
'Author' => 'peewpw',
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2017-12617' ],
[ 'URL', 'http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12617' ],
[ 'URL', 'https://bz.apache.org/bugzilla/show_bug.cgi?id=61542' ]
],
'Privileged' => false,
'Platform' => %w{ linux win }, # others?
'Targets' =>
[
[ 'Automatic',
{
'Arch' => ARCH_JAVA,
'Platform' => 'win'
}
],
[ 'Java Windows',
{
'Arch' => ARCH_JAVA,
'Platform' => 'win'
}
],
[ 'Java Linux
Exploit-DB
Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (2)
exploitdb·2017-10-09
CVE-2017-12617 Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (2)
Apache Tomcat ')
txt = re.sub(remove, '\n', tags)
return txt.replace("\n\n\n","\n")
def getContent(url,f):
headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
re=requests.get(str(url)+"/"+str(f), headers=headers)
return re.content
def createPayload(url,f):
evil=''
headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
req=requests.put(str(url)+str(f)+"/",data=evil, headers=headers)
if req.status_code==201:
print ("File Created ..")
def RCE(url,f):
EVIL="""""".format(f)+"""
"; }
} catch(IOException e) { e.printStackTrace(); }
}
%>
"""
headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Ma
Metasploit
Tomcat RCE via JSP Upload Bypass
metasploit
Tomcat RCE via JSP Upload Bypass
Tomcat RCE via JSP Upload Bypass
This module uses a PUT request bypass to upload a jsp shell to a vulnerable Apache Tomcat configuration.
Nuclei
Apache Tomcat - Remote Code Execution
nuclei·CVSS 8.1
CVE-2017-12617 [HIGH] Apache Tomcat - Remote Code Execution
Apache Tomcat - Remote Code Execution
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Template:
id: CVE-2017-12617
info:
name: Apache Tomcat - Remote Code Execution
author: pussycat0x
severity: high
description: |
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was
Greynoiseio
Coordinated Cloud-Based Scanning Operation Targets 75 Known Exposure Points in One Day
blogs_greynoiseio·2025-05-27
Coordinated Cloud-Based Scanning Operation Targets 75 Known Exposure Points in One Day
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Tenable
Sea Turtle DNS Hijacking Campaign Utilizes At Least Seven Patched Vulnerabilities
blogs_tenable·2019-04-19
Sea Turtle DNS Hijacking Campaign Utilizes At Least Seven Patched Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
DNS Hijacking Abuses Trust In Core Internet Service
blogs_talos·2019-04-17
DNS Hijacking Abuses Trust In Core Internet Service
By Danny Adamitis, David Maynor, Warren Mercer, Matthew Olney and Paul Rascagneres.
Update 4/18: A correction has been made to our research based on feedback from Packet Clearing House, we thank them for their assistance
## Preface
This blog post discusses the technical details of a state-sponsored attack manipulating DNS systems. While this incident is limited to targeting primarily national security organizations in the Middle East and North Africa, and we do not want to overstate the consequences of this specific campaign, we are concerned that the success of this operation will lead to actors more broadly attacking the global DNS system. DNS is a foundational technology supporting the Internet. Manipulating that system has the potential to undermine the trust users have on the inter
Talos
DNS Hijacking Abuses Trust In Core Internet Service
blogs_talos·2019-04-17
DNS Hijacking Abuses Trust In Core Internet Service
## DNS Hijacking Abuses Trust In Core Internet Service
By Danny Adamitis , David Maynor , Warren Mercer , Matthew Olney and Paul Rascagneres . Update 4/18: A correction has been made to our research based on feedback from Packet Clearing House, we thank them for their assistance
## Preface
This blog post discusses the technical details of a state-sponsored attack manipulating DNS systems. While this incident is limited to targeting primarily national security organizations in the Middle East and North Africa, and we do not want to overstate the consequences of this specific campaign, we are concerned that the success of this operation will lead to actors more broadly attacking the global DNS system. DNS is a foundational technology supporting the Internet. Manipulating that system has t
Greynoiseio
NoiseLetter August 2024
blogs_greynoiseio
NoiseLetter August 2024
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
arXiv
ATTACK2VEC: Leveraging Temporal Word Embeddings to Understand the Evolution of Cyberattacks
arxiv_fulltext·2019-05-29
ATTACK2VEC: Leveraging Temporal Word Embeddings to Understand the Evolution of Cyberattacks
: Leveraging Temporal Word Embeddings to
Understand the Evolution of Cyberattacks
## Abstract
Despite the fact that cyberattacks are constantly growing in complexity, the research community still lacks effective tools to easily monitor and understand them.
In particular, there is a need for techniques that are able to not only track how prominently certain malicious actions, such as the exploitation of specific vulnerabilities, are exploited in the wild, but also (and more importantly) how these malicious actions factor in as attack steps in more complex cyberattacks.
In this paper we present , a system that uses temporal word embeddings to model how attack steps are exploited in the wild, and track how they evolve.
We test on a dataset of billions of security events collected from the c
Bugzilla
CVE-2017-12617 tomcat: Remote Code Execution bypass for CVE-2017-12615 [fedora-all]
bugzilla·2017-10-02·CVSS 8.1
CVE-2017-12617 [HIGH] CVE-2017-12617 tomcat: Remote Code Execution bypass for CVE-2017-12615 [fedora-all]
CVE-2017-12617 tomcat: Remote Code Execution bypass for CVE-2017-12615 [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported ve
Bugzilla
CVE-2017-12617 tomcat: Remote Code Execution bypass for CVE-2017-12615 [epel-6]
bugzilla·2017-10-02·CVSS 8.1
CVE-2017-12617 [HIGH] CVE-2017-12617 tomcat: Remote Code Execution bypass for CVE-2017-12615 [epel-6]
CVE-2017-12617 tomcat: Remote Code Execution bypass for CVE-2017-12615 [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-6.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the following template to for the 'fe
Bugzilla
CVE-2017-12617 tomcat: Remote Code Execution bypass for CVE-2017-12615
bugzilla·2017-09-21·CVSS 8.1
CVE-2017-12617 [HIGH] CVE-2017-12617 tomcat: Remote Code Execution bypass for CVE-2017-12615
CVE-2017-12617 tomcat: Remote Code Execution bypass for CVE-2017-12615
When running on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. This issue affects Apache Tomcat versions up to and including 7.0.81. The fix for CVE-2017-12615 does not prevent this issue.
Discussion:
External References:
https://tomcat.apache.org/security-7.html
https://tomcat.apache.org/security-8.html
---
Created tomcat tracking bugs for this issue:
Affects: epel-6 [bug 1497681]
Affects: fedora-all [bug 1497682]
---
Mitigation:
Ensure that readonly is set to true (the de
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlhttp://www.securityfocus.com/bid/100954http://www.securitytracker.com/id/1039552https://access.redhat.com/errata/RHSA-2017:3080https://access.redhat.com/errata/RHSA-2017:3081https://access.redhat.com/errata/RHSA-2017:3113https://access.redhat.com/errata/RHSA-2017:3114https://access.redhat.com/errata/RHSA-2018:0268https://access.redhat.com/errata/RHSA-2018:0269https://access.redhat.com/errata/RHSA-2018:0270https://access.redhat.com/errata/RHSA-2018:0271https://access.redhat.com/errata/RHSA-2018:0275https://access.redhat.com/errata/RHSA-2018:0465https://access.redhat.com/errata/RHSA-2018:0466https://access.redhat.com/errata/RHSA-2018:2939https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb%40%3Cannounce.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2017/11/msg00009.htmlhttps://security.netapp.com/advisory/ntap-20171018-0002/https://security.netapp.com/advisory/ntap-20180117-0002/https://support.f5.com/csp/article/K53173544https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03812en_ushttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_ushttps://usn.ubuntu.com/3665-1/https://www.exploit-db.com/exploits/42966/https://www.exploit-db.com/exploits/43008/https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlhttp://www.securityfocus.com/bid/100954http://www.securitytracker.com/id/1039552https://access.redhat.com/errata/RHSA-2017:3080https://access.redhat.com/errata/RHSA-2017:3081https://access.redhat.com/errata/RHSA-2017:3113https://access.redhat.com/errata/RHSA-2017:3114https://access.redhat.com/errata/RHSA-2018:0268https://access.redhat.com/errata/RHSA-2018:0269https://access.redhat.com/errata/RHSA-2018:0270https://access.redhat.com/errata/RHSA-2018:0271https://access.redhat.com/errata/RHSA-2018:0275https://access.redhat.com/errata/RHSA-2018:0465https://access.redhat.com/errata/RHSA-2018:0466https://access.redhat.com/errata/RHSA-2018:2939https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb%40%3Cannounce.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2017/11/msg00009.htmlhttps://security.netapp.com/advisory/ntap-20171018-0002/https://security.netapp.com/advisory/ntap-20180117-0002/https://support.f5.com/csp/article/K53173544https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03812en_ushttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_ushttps://usn.ubuntu.com/3665-1/https://www.exploit-db.com/exploits/42966/https://www.exploit-db.com/exploits/43008/https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12617
2017-10-04
Published
2022-03-25
Added to CISA KEV
Exploited in the wild