Secuno
ENNL
Book demo

CVE-2017-12617

Apache Tomcat Remote Code Execution

8.1 HIGHActively exploited (CISA KEV)Public exploitEPSS 100.0%
  1. Published3 Oct 2017
  2. Added to CISA KEV25 Mar 2022
  3. Remediation due15 Apr 2022
Actively exploited (CISA KEV)

When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Added to KEV: 25 Mar 2022Federal remediation due: 15 Apr 2022

Description

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityHigh
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Apache Tomcat≥ 7.0.0 < 7.0.82 · ≥ 8.0 < 8.0.47 · ≥ 8.5.0 < 8.5.23 · ≥ 9.0.0 < 9.0.1
Netapp Active Iq Unified Manager≥ 9.5 · ≥ 7.3
Netapp Oncommand Balanceall versions
Netapp Oncommand Insightall versions
Netapp Oncommand Shiftall versions
Netapp Oncommand Workflow Automationall versions
Netapp Snapcenterall versions
Oracle Agile Product Lifecycle Management9.3.3 · 9.3.4 · 9.3.5 · 9.3.6
Oracle Communications Instant Messaging Server10.0.1
Oracle Endeca Information Discovery Integrator3.1.0 · 3.2.0
Oracle Enterprise Manager For Mysql Database12.1.0.4.0
Oracle Financial Services Analytical Applications Infrastructure≥ 7.3.3.0.0 ≤ 7.3.5.3.0 · ≥ 8.0.0.0.0 ≤ 8.0.9.0.0
Oracle Fmw Platform12.2.1.2.0 · 12.2.1.3.0
Oracle Health Sciences Empirica Inspections1.0.1.1
Oracle Hospitality Guest Access4.2.0 · 4.2.1
Oracle Instantis Enterprisetrack17.1 · 17.2
Oracle Management Pack11.2.1.0.13
Oracle Micros Lucas2.9.5
Oracle Micros Retail Xbri Loss Prevention10.0.1 · 10.5.0 · 10.6.0 · 10.7.0
Oracle Mysql Enterprise Monitor≥ 3.4.0 ≤ 3.4.4.4226 · ≥ 4.0.0 ≤ 4.0.0.5135 · ≤ 3.3.6.3293
Oracle Retail Advanced Inventory Planning13.2 · 13.4 · 14.1 · 15.0
Oracle Retail Back Office14.0.4 · 14.1.3
Oracle Retail Central Office14.0.4 · 14.1.3
Oracle Retail Convenience And Fuel Pos Software2.1.132

Remediation

Fixed in
Apache Tomcat≥ 7.0.82

References

and 35 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1040289.8
The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability…
CVE-2026-621299.9
Contributor Arbitrary File Upload in Creator LMS <= 1.2.21…
CVE-2026-620259.0
Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3…
CVE-2026-620249.9
Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2…
CVE-2026-835268.8
The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all…
CVE-2026-1038899.8
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to…

Frequently asked

Is CVE-2017-12617 being actively exploited?

Yes. CVE-2017-12617 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 25 Mar 2022.

How severe is CVE-2017-12617?

CVE-2017-12617 has a CVSS 3.1 base score of 8.1, rated high. EPSS estimates a 100.0% probability of exploitation.

Which products are affected by CVE-2017-12617?

Affected products include Apache Tomcat, Netapp Active Iq Unified Manager, Netapp Oncommand Balance, Netapp Oncommand Insight, Netapp Oncommand Shift, and 19 more.

How do I fix CVE-2017-12617?

Upgrade affected software to a fixed version, for example Apache Tomcat 7.0.82 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2017-12617 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.