CVE-2017-12617

8.1 highKEVEPSS 100%

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Severity

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 100% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2022-03-25, due 2022-04-15
CWE: CWE-434
Published: 2017-10-04
Modified: 2026-08-25
Record from: the NVD, synced 2026-10-19

Affected

apache:tomcat
canonical:ubuntu_linux
debian:debian_linux
netapp:active_iq_unified_manager
netapp:element
netapp:oncommand_balance
netapp:oncommand_insight
netapp:oncommand_shift
netapp:oncommand_workflow_automation
netapp:snapcenter
oracle:agile_product_lifecycle_management
oracle:communications_instant_messaging_server
oracle:endeca_information_discovery_integrator
oracle:enterprise_manager_for_mysql_database
oracle:financial_services_analytical_applications_infrastructure
oracle:fmw_platform
oracle:health_sciences_empirica_inspections
oracle:hospitality_guest_access
oracle:instantis_enterprisetrack
oracle:management_pack
oracle:micros_lucas
oracle:micros_retail_xbri_loss_prevention
oracle:mysql_enterprise_monitor
oracle:retail_advanced_inventory_planning
oracle:retail_back_office
oracle:retail_central_office
oracle:retail_convenience_and_fuel_pos_software
oracle:retail_eftlink
oracle:retail_insights
oracle:retail_invoice_matching
oracle:retail_order_broker
oracle:retail_order_management_system
oracle:retail_point-of-service
oracle:retail_price_management
oracle:retail_returns_management
oracle:retail_store_inventory_management
oracle:retail_xstore_point_of_service
oracle:transportation_management
oracle:tuxedo_system_and_applications_monitor
oracle:webcenter_sites
oracle:workload_manager
redhat:enterprise_linux_desktop
redhat:enterprise_linux_eus
redhat:enterprise_linux_eus_compute_node
redhat:enterprise_linux_for_ibm_z_systems
redhat:enterprise_linux_for_ibm_z_systems_eus
redhat:enterprise_linux_for_power_big_endian
redhat:enterprise_linux_for_power_big_endian_eus
redhat:enterprise_linux_for_power_little_endian
redhat:enterprise_linux_for_power_little_endian_eus

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-xjgh-84hx-56c5	Maven	org.apache.tomcat:tomcat-catalina	>=9.0.0.M1 <9.0.1	9.0.1
GHSA-xjgh-84hx-56c5	Maven	org.apache.tomcat:tomcat-catalina	>=8.5.0 <8.5.23	8.5.23
GHSA-xjgh-84hx-56c5	Maven	org.apache.tomcat:tomcat-catalina	>=8.0.0-RC1 <8.0.47	8.0.47
GHSA-xjgh-84hx-56c5	Maven	org.apache.tomcat:tomcat-catalina	>=7.0.0 <7.0.82	7.0.82
GHSA-xjgh-84hx-56c5	Maven	org.apache.tomcat.embed:tomcat-embed-core	>=9.0.0.M1 <9.0.1	9.0.1
GHSA-xjgh-84hx-56c5	Maven	org.apache.tomcat.embed:tomcat-embed-core	>=8.5.0 <8.5.23	8.5.23
GHSA-xjgh-84hx-56c5	Maven	org.apache.tomcat.embed:tomcat-embed-core	>=8.0.0-RC1 <8.0.47	8.0.47
GHSA-xjgh-84hx-56c5	Maven	org.apache.tomcat.embed:tomcat-embed-core	>=7.0.0 <7.0.82	7.0.82

References

Check your stack JSON