ZeroDay Findings
Sign inSign up

Findings

CVE-2017-12617

Apache Tomcat Remote Code Execution Vulnerability

Published Oct 3, 2017 · updated Aug 25, 2026 · apache tomcat

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 3, 2017 · Catalog

    Detected

    When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

  2. Mar 25, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Apr 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Aug 25, 2026 · Catalog

    Updated

    When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Required action

Apply updates per vendor instructions.

CISA due date Apr 15, 2022

Affected

  • cpe apache/tomcatversion unspecified
  • cpe canonical/ubuntu linux12.04
  • cpe canonical/ubuntu linux16.04
  • cpe canonical/ubuntu linux17.10
  • cpe canonical/ubuntu linux18.04
  • cpe debian/debian linux7.0
  • cpe netapp/active iq unified managerversion unspecified
  • cpe oracle/agile product lifecycle management9.3.3
  • cpe redhat/fuse1.0
  • vendor Apache Tomcatversion unspecified

Sources

  • CISA KEVCVE-2017-12617

    When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

    cisa.gov
  • CVE.orgCVE-2017-12617

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2017-12617

    30-day exploitation probability 100.0%

    first.org
  • Exploit Database42966

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database43008

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_multi/http/tomcat_jsp_upload_bypass

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2017-12617

    When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a

    nvd.nist.gov

References