{"cve_id":"CVE-2017-12615","published":"2017-09-19T13:29:00.190000+00:00","last_modified":"2026-08-06T05:16:34.690000+00:00","vuln_status":"Analyzed","description":"When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","base_score":8.1,"base_severity":"HIGH","attack_vector":"NETWORK","privileges_req":"NONE","user_interaction":"NONE","scope":"UNCHANGED","impact_c":"HIGH","impact_i":"HIGH","impact_a":"HIGH","cwe_ids":["CWE-434"],"in_kev":true,"kev_date_added":"2022-03-25","kev_ransomware":true,"epss_score":0.99707,"epss_percentile":0.99952,"cap_rule_version":"0.1.1","stage":"INITIAL_ACCESS","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":false,"grant_access":"USER","caps":["CODE_EXEC"],"terminal":false,"cap_confidence":"high","ingested_at":"2026-09-18T08:38:56.699656+00:00","first_seen":"2017-09-19T13:29:00.190000+00:00","kev_first_seen":"2022-03-25T00:00:00+00:00","novelty_score":0.0,"novelty_reasons":[],"novelty_at":null,"vendors":["apache","microsoft","netapp","redhat"],"products":["7-mode_transition_tool","enterprise_linux_desktop","enterprise_linux_eus","enterprise_linux_eus_compute_node","enterprise_linux_for_ibm_z_systems","enterprise_linux_for_ibm_z_systems_eus","enterprise_linux_for_power_big_endian","enterprise_linux_for_power_big_endian_eus","enterprise_linux_for_power_little_endian","enterprise_linux_for_power_little_endian_eus","enterprise_linux_for_scientific_computing","enterprise_linux_server","enterprise_linux_server_aus","enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions","enterprise_linux_server_tus","enterprise_linux_server_update_services_for_sap_solutions","enterprise_linux_workstation","jboss_enterprise_web_server","jboss_enterprise_web_server_text-only_advisories","oncommand_balance","oncommand_shift","tomcat","windows"],"affected":[{"vendor":"apache","product":"tomcat","ranges":["≥ 7.0.0 and ≤ 7.0.79"]},{"vendor":"netapp","product":"7-mode_transition_tool","ranges":["all versions"]},{"vendor":"netapp","product":"oncommand_balance","ranges":["all versions"]},{"vendor":"netapp","product":"oncommand_shift","ranges":["all versions"]},{"vendor":"redhat","product":"enterprise_linux_desktop","ranges":["6.0","7.0"]},{"vendor":"redhat","product":"enterprise_linux_eus","ranges":["7.7","7.4","7.5","7.6"]},{"vendor":"redhat","product":"enterprise_linux_eus_compute_node","ranges":["7.7","7.6","7.5","7.4"]},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems","ranges":["7.0_s390x"]},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems_eus","ranges":["7.7_s390x","7.4_s390x","7.5_s390x","7.6_s390x"]},{"vendor":"redhat","product":"enterprise_linux_for_power_big_endian","ranges":["7.0_ppc64"]},{"vendor":"redhat","product":"enterprise_linux_for_power_big_endian_eus","ranges":["7.7_ppc64","7.6_ppc64","7.5_ppc64","7.4_ppc64"]},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian","ranges":["7.0_ppc64le"]},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian_eus","ranges":["7.7_ppc64le","7.4_ppc64le","7.5_ppc64le","7.6_ppc64le"]},{"vendor":"redhat","product":"enterprise_linux_for_scientific_computing","ranges":["7.0"]},{"vendor":"redhat","product":"enterprise_linux_server","ranges":["7.0","6.0"]},{"vendor":"redhat","product":"enterprise_linux_server_aus","ranges":["7.4","7.6","7.7"]},{"vendor":"redhat","product":"enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions","ranges":["7.4_ppc64le","7.7_ppc64le","9.2_ppc64le","7.6_ppc64le"]},{"vendor":"redhat","product":"enterprise_linux_server_tus","ranges":["7.4","7.6","7.7"]},{"vendor":"redhat","product":"enterprise_linux_server_update_services_for_sap_solutions","ranges":["7.7","7.6","7.4"]},{"vendor":"redhat","product":"enterprise_linux_workstation","ranges":["7.0","6.0"]},{"vendor":"redhat","product":"jboss_enterprise_web_server","ranges":["3.0.0","2.0.0"]},{"vendor":"redhat","product":"jboss_enterprise_web_server_text-only_advisories","ranges":["all versions"]}]}