Secuno
ENNL
Book demo

CVE-2017-12615

Apache Tomcat on Windows Remote Code Execution

8.1 HIGHActively exploited (CISA KEV)Used in ransomwarePublic exploitEPSS 99.6%
  1. Published19 Sept 2017
  2. Added to CISA KEV25 Mar 2022
  3. Remediation due15 Apr 2022
Actively exploited (CISA KEV)

When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Added to KEV: 25 Mar 2022Federal remediation due: 15 Apr 2022Used in ransomware

Description

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityHigh
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Apache Tomcat≥ 7.0.0 ≤ 7.0.79
Netapp 7-mode Transition Toolall versions
Netapp Oncommand Balanceall versions
Netapp Oncommand Shiftall versions
Redhat Enterprise Linux Server Update Services For Sap Solutions7.4 · 7.6 · 7.7
Redhat Jboss Enterprise Web Server2.0.0 · 3.0.0
Redhat Jboss Enterprise Web Server Text-only Advisoriesall versions
Redhat Enterprise Linux Desktop6.0 · 7.0
Redhat Enterprise Linux Eus7.4 · 7.5 · 7.6 · 7.7
Redhat Enterprise Linux Eus Compute Node7.4 · 7.5 · 7.6 · 7.7
Redhat Enterprise Linux For Ibm Z Systems7.0_s390x
Redhat Enterprise Linux For Ibm Z Systems Eus7.4_s390x · 7.5_s390x · 7.6_s390x · 7.7_s390x
Redhat Enterprise Linux For Power Big Endian7.0_ppc64
Redhat Enterprise Linux For Power Big Endian Eus7.4_ppc64 · 7.5_ppc64 · 7.6_ppc64 · 7.7_ppc64
Redhat Enterprise Linux For Power Little Endian7.0_ppc64le
Redhat Enterprise Linux For Power Little Endian Eus7.4_ppc64le · 7.5_ppc64le · 7.6_ppc64le · 7.7_ppc64le
Redhat Enterprise Linux For Scientific Computing7.0
Redhat Enterprise Linux Server6.0 · 7.0
Redhat Enterprise Linux Server Aus7.4 · 7.6 · 7.7
Redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions7.4_ppc64le · 7.6_ppc64le · 7.7_ppc64le · 9.2_ppc64le
Redhat Enterprise Linux Server Tus7.4 · 7.6 · 7.7
Redhat Enterprise Linux Workstation6.0 · 7.0

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

and 10 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1040289.8
The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability…
CVE-2026-621299.9
Contributor Arbitrary File Upload in Creator LMS <= 1.2.21…
CVE-2026-620259.0
Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3…
CVE-2026-620249.9
Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2…
CVE-2026-835268.8
The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all…
CVE-2026-1038899.8
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to…

Frequently asked

Is CVE-2017-12615 being actively exploited?

Yes. CVE-2017-12615 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 25 Mar 2022. It has been used in ransomware campaigns.

How severe is CVE-2017-12615?

CVE-2017-12615 has a CVSS 3.1 base score of 8.1, rated high. EPSS estimates a 99.6% probability of exploitation.

Which products are affected by CVE-2017-12615?

Affected products include Apache Tomcat, Netapp 7-mode Transition Tool, Netapp Oncommand Balance, Netapp Oncommand Shift, Redhat Enterprise Linux Server Update Services For Sap Solutions, and 17 more.

How do I fix CVE-2017-12615?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2017-12615 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.