8.1 High Exploited · ransomware

CVE-2017-12615 Apache Tomcat on Windows Remote Code Execution Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Known to be used

Weakness CWE-434

Description

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Affected products and versions

Product	Affected versions	Fixed in
Apache Tomcat	Versions not published

References

RHSA-2017:3113 access.redhat.com
RHSA-2017:3080 access.redhat.com
1039392 www.securitytracker.com
[announce] 20170919 [SECURITY] CVE-2017-12615 Apache Tomcat Remote Code Execution via JSP upload lists.apache.org
www.synology.com www.synology.com
RHSA-2018:0465 access.redhat.com
breaktoprotect.blogspot.com breaktoprotect.blogspot.com
RHSA-2017:3114 access.redhat.com
100901 www.securityfocus.com
RHSA-2018:0466 access.redhat.com
42953 www.exploit-db.com
security.netapp.com security.netapp.com
github.com github.com
RHSA-2017:3081 access.redhat.com
[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ lists.apache.org
[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org
[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ lists.apache.org
[announce] 20200131 Apache Software Foundation Security Report: 2019 lists.apache.org
[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ lists.apache.org

Timeline

Published September 19, 2017
Added to the KEV catalogue March 25, 2022
Last modified August 6, 2026

The 141 CVEs of Apache Tomcat →

CVE-2026-103119 Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body… Not rated CVE-2026-101356 Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous… Not rated CVE-2026-101296 A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with… Not rated CVE-2026-93446 Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently Not rated

Track this CVE