CVE-2017-12615

Severity

8.1

Description

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Mitigation

We recommend upgrading to a version of this component that is not vulnerable to this specific issue.

Related links:

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12615

https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.81

Project

Apache Tomcat

Category

Remote Code Execution

Tags

data

operational

Date Disclosed

2017-09-19

Date Discovered

2017-08-07

Apache Tomcat 7.0.x

First release:

2011-01-14

First release:

2021-03-31

CVEs:

55

Support Lifecycle:

Maintenance Support

Namespace:

javax

Apache Tomcat 6.0.x

First release:

2007-02-28

First release:

2016-12-31

CVEs:

50

Support Lifecycle:

Namespace:

javax

6.0.13 6.0.14 6.0.16 6.0.18 6.0.20 6.0.24 6.0.26 6.0.28 6.0.29 6.0.30 6.0.32 6.0.33 6.0.35 6.0.36 6.0.37 6.0.39 6.0.41 6.0.43 6.0.44 6.0.45 6.0.47 6.0.48 6.0.51 6.0.53

Apache TomEE 1.7.x

First release:

2014-08-09

CVEs:

95

Support Lifecycle:

Namespace:

javax

1.7.0 1.7.1 1.7.2 1.7.3 1.7.4

Apache TomEE 1.6.x

First release:

2013-11-17

CVEs:

108

Support Lifecycle:

Namespace:

javax

1.6.0 1.6.0.1 1.6.0.2

Apache TomEE 1.5.x

First release:

2012-09-28

CVEs:

119

Support Lifecycle:

Namespace:

javax

1.5.0 1.5.1 1.5.2

Apache TomEE 1.0.x

First release:

2012-04-27

CVEs:

130

Support Lifecycle:

Namespace:

javax

Feel Vulnerable?

Contact us so we can help you.

First name ^*
Last name ^*
Email ^*
Company ^*
Product ^*
Heard about us from: ^*
Tell us more ^*

Send me a confirmation email

^* These fields are required.