← Vulnerability Intelligence

CVE-2017-12617

High 8.1 Exploited in the wild (KEV)

Confirmed active exploitation — CISA KEV catalog

Name
Apache Tomcat Remote Code Execution Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Metrics

CVSS 3.1
8.1 (HIGH) Score source: NVD CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
100% (percentile: 100) as of 1 November 2026
CWE
CWE-434

Affected products

apache: tomcat; canonical: ubuntu linux; oracle: agile product lifecycle management; oracle: communications instant messaging server; oracle: endeca information discovery integrator; oracle: enterprise manager for mysql database; oracle: financial services analytical applications infrastructure; oracle: fmw platform; oracle: health sciences empirica inspections; oracle: hospitality guest access; oracle: instantis enterprisetrack; oracle: management pack; oracle: micros lucas; oracle: micros retail xbri loss prevention; oracle: mysql enterprise monitor

References