{"cve_id":"CVE-2017-12617","published":"2017-10-04T01:29:02.120000+00:00","last_modified":"2026-08-25T16:28:27.310000+00:00","vuln_status":"Analyzed","description":"When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","base_score":8.1,"base_severity":"HIGH","attack_vector":"NETWORK","privileges_req":"NONE","user_interaction":"NONE","scope":"UNCHANGED","impact_c":"HIGH","impact_i":"HIGH","impact_a":"HIGH","cwe_ids":["CWE-434"],"in_kev":true,"kev_date_added":"2022-03-25","kev_ransomware":false,"epss_score":0.99968,"epss_percentile":0.99977,"cap_rule_version":"0.1.1","stage":"INITIAL_ACCESS","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":false,"grant_access":"USER","caps":["CODE_EXEC"],"terminal":false,"cap_confidence":"high","ingested_at":"2026-09-18T08:38:56.699656+00:00","first_seen":"2017-10-04T01:29:02.120000+00:00","kev_first_seen":"2022-03-25T00:00:00+00:00","novelty_score":0.0,"novelty_reasons":[],"novelty_at":null,"vendors":["apache","canonical","debian","netapp","oracle","redhat"],"products":["active_iq_unified_manager","agile_product_lifecycle_management","communications_instant_messaging_server","debian_linux","element","endeca_information_discovery_integrator","enterprise_linux_desktop","enterprise_linux_eus","enterprise_linux_eus_compute_node","enterprise_linux_for_ibm_z_systems","enterprise_linux_for_ibm_z_systems_eus","enterprise_linux_for_power_big_endian","enterprise_linux_for_power_big_endian_eus","enterprise_linux_for_power_little_endian","enterprise_linux_for_power_little_endian_eus","enterprise_linux_server","enterprise_linux_server_aus","enterprise_linux_server_tus","enterprise_linux_workstation","enterprise_manager_for_mysql_database","financial_services_analytical_applications_infrastructure","fmw_platform","fuse","health_sciences_empirica_inspections","hospitality_guest_access","instantis_enterprisetrack","jboss_enterprise_application_platform","jboss_enterprise_web_server","jboss_enterprise_web_server_text-only_advisories","management_pack","micros_lucas","micros_retail_xbri_loss_prevention","mysql_enterprise_monitor","oncommand_balance","oncommand_insight","oncommand_shift","oncommand_workflow_automation","retail_advanced_inventory_planning","retail_back_office","retail_central_office","retail_convenience_and_fuel_pos_software","retail_eftlink","retail_insights","retail_invoice_matching","retail_order_broker","retail_order_management_system","retail_point-of-service","retail_price_management","retail_returns_management","retail_store_inventory_management","retail_xstore_point_of_service","snapcenter","tomcat","transportation_management","tuxedo_system_and_applications_monitor","ubuntu_linux","webcenter_sites","workload_manager"],"affected":[{"vendor":"apache","product":"tomcat","ranges":["≥ 8.5.0 and < 8.5.23","≥ 8.0 and < 8.0.47","≥ 9.0.0 and < 9.0.1","≥ 7.0.0 and < 7.0.82"]},{"vendor":"canonical","product":"ubuntu_linux","ranges":["17.10","12.04","18.04","16.04"]},{"vendor":"debian","product":"debian_linux","ranges":["7.0"]},{"vendor":"netapp","product":"active_iq_unified_manager","ranges":["≥ 7.3","≥ 9.5"]},{"vendor":"netapp","product":"element","ranges":["all versions"]},{"vendor":"netapp","product":"oncommand_balance","ranges":["all versions"]},{"vendor":"netapp","product":"oncommand_insight","ranges":["all versions"]},{"vendor":"netapp","product":"oncommand_shift","ranges":["all versions"]},{"vendor":"netapp","product":"oncommand_workflow_automation","ranges":["all versions"]},{"vendor":"netapp","product":"snapcenter","ranges":["all versions"]},{"vendor":"oracle","product":"agile_product_lifecycle_management","ranges":["9.3.4","9.3.5","9.3.6","9.3.3"]},{"vendor":"oracle","product":"communications_instant_messaging_server","ranges":["10.0.1"]},{"vendor":"oracle","product":"endeca_information_discovery_integrator","ranges":["3.1.0","3.2.0"]},{"vendor":"oracle","product":"enterprise_manager_for_mysql_database","ranges":["12.1.0.4.0"]},{"vendor":"oracle","product":"financial_services_analytical_applications_infrastructure","ranges":["≥ 8.0.0.0.0 and ≤ 8.0.9.0.0","≥ 7.3.3.0.0 and ≤ 7.3.5.3.0"]},{"vendor":"oracle","product":"fmw_platform","ranges":["12.2.1.3.0","12.2.1.2.0"]},{"vendor":"oracle","product":"health_sciences_empirica_inspections","ranges":["1.0.1.1"]},{"vendor":"oracle","product":"hospitality_guest_access","ranges":["4.2.1","4.2.0"]},{"vendor":"oracle","product":"instantis_enterprisetrack","ranges":["17.1","17.2"]},{"vendor":"oracle","product":"management_pack","ranges":["11.2.1.0.13"]},{"vendor":"oracle","product":"micros_lucas","ranges":["2.9.5"]},{"vendor":"oracle","product":"micros_retail_xbri_loss_prevention","ranges":["10.8.0","10.7.0","10.6.0","10.5.0","10.0.1","10.8.1"]},{"vendor":"oracle","product":"mysql_enterprise_monitor","ranges":["≥ 3.4.0 and ≤ 3.4.4.4226","≥ 4.0.0 and ≤ 4.0.0.5135","≤ 3.3.6.3293"]},{"vendor":"oracle","product":"retail_advanced_inventory_planning","ranges":["13.2","14.1","13.4","15.0"]},{"vendor":"oracle","product":"retail_back_office","ranges":["14.0.4","14.1.3"]},{"vendor":"oracle","product":"retail_central_office","ranges":["14.0.4","14.1.3"]},{"vendor":"oracle","product":"retail_convenience_and_fuel_pos_software","ranges":["2.1.132"]},{"vendor":"oracle","product":"retail_eftlink","ranges":["16.0.2","1.1.124","15.0.1"]},{"vendor":"oracle","product":"retail_insights","ranges":["16.0","15.0","14.1","14.0"]},{"vendor":"oracle","product":"retail_invoice_matching","ranges":["14.1","12.0","13.1","13.0","16.0","15.0","13.2","14.0"]},{"vendor":"oracle","product":"retail_order_broker","ranges":["5.1","5.2","15.0","16.0","5.0"]},{"vendor":"oracle","product":"retail_order_management_system","ranges":["5.0","4.7","4.5","4.0"]},{"vendor":"oracle","product":"retail_point-of-service","ranges":["14.0.4","14.1.3"]},{"vendor":"oracle","product":"retail_price_management","ranges":["16.0","12.0","13.0","13.1","13.2","14.0","14.1","15.0"]},{"vendor":"oracle","product":"retail_returns_management","ranges":["2.4.9","14.0.4","14.1.3","2.3.8"]},{"vendor":"oracle","product":"retail_store_inventory_management","ranges":["14.1.3","15.0.2","16.0.1","14.0.4","13.2.9","13.1.9","13.0.7","12.0.12"]},{"vendor":"oracle","product":"retail_xstore_point_of_service","ranges":["15.0.1","6.0.11","7.0.6","7.1.6"]},{"vendor":"oracle","product":"transportation_management","ranges":["6.3.5","6.3.7","6.3.3","6.3.4","6.3.6","6.3.1","6.3.2"]},{"vendor":"oracle","product":"tuxedo_system_and_applications_monitor","ranges":["12.1.3.0.0"]},{"vendor":"oracle","product":"webcenter_sites","ranges":["11.1.1.8.0"]},{"vendor":"oracle","product":"workload_manager","ranges":["12.2.0.1"]},{"vendor":"redhat","product":"enterprise_linux_desktop","ranges":["7.0","6.0"]},{"vendor":"redhat","product":"enterprise_linux_eus","ranges":["7.5","7.7","7.4","7.6"]},{"vendor":"redhat","product":"enterprise_linux_eus_compute_node","ranges":["7.6","7.5","7.4","7.7"]},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems","ranges":["6.0_s390x","7.0_s390x"]},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems_eus","ranges":["7.4_s390x","7.7_s390x","7.6_s390x","7.5_s390x"]},{"vendor":"redhat","product":"enterprise_linux_for_power_big_endian","ranges":["7.0_ppc64","6.0_ppc64"]},{"vendor":"redhat","product":"enterprise_linux_for_power_big_endian_eus","ranges":["7.5_ppc64","7.6_ppc64","7.7_ppc64","7.4_ppc64"]},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian","ranges":["7.0"]},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian_eus","ranges":["7.6_ppc64le","7.4_ppc64le","7.5_ppc64le","7.7_ppc64le"]},{"vendor":"redhat","product":"enterprise_linux_server","ranges":["6.0","7.0"]},{"vendor":"redhat","product":"enterprise_linux_server_aus","ranges":["7.6","7.7","7.4"]},{"vendor":"redhat","product":"enterprise_linux_server_tus","ranges":["7.6","7.4","7.7"]},{"vendor":"redhat","product":"enterprise_linux_workstation","ranges":["6.0","7.0"]},{"vendor":"redhat","product":"fuse","ranges":["1.0"]},{"vendor":"redhat","product":"jboss_enterprise_application_platform","ranges":["6.0.0","6.4.0"]},{"vendor":"redhat","product":"jboss_enterprise_web_server","ranges":["3.0.0","2.0.0"]},{"vendor":"redhat","product":"jboss_enterprise_web_server_text-only_advisories","ranges":["all versions"]}]}