QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2017-12617

Back to search

CVE-2017-12617

Published: Oct 3, 2017

Modified: Oct 21, 2025

PUBLISHED

Description

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

VendorProductVersions

Apache Software Foundation

Apache Tomcat

affected
9.0.0.M1 to 9.0.0
affected
8.5.0 to 8.5.22
affected
8.0.0.RC1 to 8.0.46
affected
7.0.0 to 7.0.81

References

RHSA-2017:3113
vendor-advisory
x_refsource_REDHAT
RHSA-2017:3080
vendor-advisory
x_refsource_REDHAT
RHSA-2018:0269
vendor-advisory
x_refsource_REDHAT
42966
exploit
x_refsource_EXPLOIT-DB
RHSA-2018:0270
vendor-advisory
x_refsource_REDHAT
RHSA-2018:0271
vendor-advisory
x_refsource_REDHAT
RHSA-2018:2939
vendor-advisory
x_refsource_REDHAT
RHSA-2018:0465
vendor-advisory
x_refsource_REDHAT
USN-3665-1
vendor-advisory
x_refsource_UBUNTU
RHSA-2018:0268
vendor-advisory
x_refsource_REDHAT
RHSA-2017:3114
vendor-advisory
x_refsource_REDHAT
43008
exploit
x_refsource_EXPLOIT-DB
1039552
vdb-entry
x_refsource_SECTRACK
100954
vdb-entry
x_refsource_BID
RHSA-2018:0275
vendor-advisory
x_refsource_REDHAT
RHSA-2018:0466
vendor-advisory
x_refsource_REDHAT
RHSA-2017:3081
vendor-advisory
x_refsource_REDHAT

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now