CVE-2017-12617

HighCVSS 8.1/10Known exploited (CISA KEV)Last modified Aug 25, 2026

Description

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
Apache Software FoundationApache Tomcat9.0.0.M1 to 9.0.0; 8.5.0 to 8.5.22; 8.0.0.RC1 to 8.0.46; 7.0.0 to 7.0.81

References

Timeline

Published
Oct 4, 2017
Last modified
Aug 25, 2026
Added to CISA KEV
Mar 25, 2022
NVD status
Analyzed

Related CVEs from 2017

CVE-2017-126184.7Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functioCVE-2017-126198.1Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reportCVE-2017-12626.1IBM Security Guardium 10.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using speciaCVE-2017-126209.8When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only aCVE-2017-126219.8During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entityCVE-2017-126227.1When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh CVE-2017-126236.5An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attaCVE-2017-126245.5Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attaCVE-2017-126254.3Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be definedCVE-2017-126267.5Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, CVE-2017-126279.8In Apache Xerces-C XML Parser library before 3.2.1, processing of external DTD paths can result in a null pointer dereference under certain CVE-2017-126287.8The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be u