8.1
Élevée
Exploitée
· rançongiciel
CVE-2017-12615 Apache Tomcat on Windows Remote Code Execution Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply updates per vendor instructions.
Campagnes de rançongiciel
Utilisation connue
Faiblesse
CWE-434
Description
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Tomcat | Versions non publiées |
Références
- RHSA-2017:3113 access.redhat.com
- RHSA-2017:3080 access.redhat.com
- 1039392 www.securitytracker.com
- [announce] 20170919 [SECURITY] CVE-2017-12615 Apache Tomcat Remote Code Execution via JSP upload lists.apache.org
- www.synology.com www.synology.com
- RHSA-2018:0465 access.redhat.com
- breaktoprotect.blogspot.com breaktoprotect.blogspot.com
- RHSA-2017:3114 access.redhat.com
- 100901 www.securityfocus.com
- RHSA-2018:0466 access.redhat.com
- 42953 www.exploit-db.com
- security.netapp.com security.netapp.com
- github.com github.com
- RHSA-2017:3081 access.redhat.com
- [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ lists.apache.org
- [announce] 20200131 Apache Software Foundation Security Report: 2019 lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ lists.apache.org
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de Apache Tomcat
Les 141 CVE de Apache Tomcat →
CVE-2026-103119
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body…
Non notée
CVE-2026-101356
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous…
Non notée
CVE-2026-101296
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with…
Non notée
CVE-2026-93446
Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently
Non notée