NetSight
IP …
high8.1Known exploitedPublic exploit code

CVE-2017-12617

Apache Tomcat Remote Code Execution Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-03-25. Federal due date: 2022-04-15.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Affected products

VendorProductAffected versions
ApacheTomcat
from 7.0.0 before 7.0.82
from 8.0 before 8.0.47
from 8.5.0 before 8.5.23
from 9.0.0 before 9.0.1
CanonicalUbuntu Linux
Versions 12.04, 16.04, 17.10, 18.04
OracleAgile Product Lifecycle Management
Versions 9.3.3, 9.3.4, 9.3.5, 9.3.6
OracleCommunications Instant Messaging Server
Version 10.0.1
OracleEndeca Information Discovery Integrator
Versions 3.1.0, 3.2.0
OracleEnterprise Manager For Mysql Database
Version 12.1.0.4.0
OracleFinancial Services Analytical Applications Infrastructure
from 7.3.3.0.0 through 7.3.5.3.0
from 8.0.0.0.0 through 8.0.9.0.0
OracleFmw Platform
Versions 12.2.1.2.0, 12.2.1.3.0
OracleHealth Sciences Empirica Inspections
Version 1.0.1.1
OracleHospitality Guest Access
Versions 4.2.0, 4.2.1
OracleInstantis Enterprisetrack
Versions 17.1, 17.2
OracleManagement Pack
Version 11.2.1.0.13

Weakness classification

CWE-434

References