CVE-2017-12617: Apache Tomcat Remote Code Execution Vulnerability

Published Sep 21, 2017
·
Updated

Last updated 25 August 2025

Other sources

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

— Launchpad

When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

— CISA

When running on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. This issue affects Apache Tomcat versions up to and including 7.0.81. The fix for CVE-2017-12615 does not prevent this issue.

— Red Hat

Affected Software

342 affected componentsFixes available
debian/tomcat7
debian/tomcat8.0
maven/org.apache.tomcat:tomcat>=8.0.0RC1<=8.0.46
8.0.47
maven/org.apache.tomcat:tomcat>=7.0.0<=7.0.81
7.0.82
maven/org.apache.tomcat:tomcat>=8.5.0<=8.5.22
8.5.23
maven/org.apache.tomcat:tomcat>=9.0.0.M1<=9.0.0M27
9.0.1
Apache Tomcat
Apache Tomcat=7.0.0
Apache Tomcat=7.0.1
Apache Tomcat=7.0.2
Apache Tomcat=7.0.2-beta
Apache Tomcat=7.0.3
Apache Tomcat=7.0.4
Apache Tomcat=7.0.4-beta
Apache Tomcat=7.0.5
Apache Tomcat=7.0.5-beta
Apache Tomcat=7.0.6
Apache Tomcat=7.0.7
Apache Tomcat=7.0.8
Apache Tomcat=7.0.9
Apache Tomcat=7.0.10
Apache Tomcat=7.0.11
Apache Tomcat=7.0.12
Apache Tomcat=7.0.13
Apache Tomcat=7.0.14
Apache Tomcat=7.0.15
Apache Tomcat=7.0.16
Apache Tomcat=7.0.17
Apache Tomcat=7.0.18
Apache Tomcat=7.0.19
Apache Tomcat=7.0.20
Apache Tomcat=7.0.21
Apache Tomcat=7.0.22
Apache Tomcat=7.0.23
Apache Tomcat=7.0.24
Apache Tomcat=7.0.25
Apache Tomcat=7.0.26
Apache Tomcat=7.0.27
Apache Tomcat=7.0.28
Apache Tomcat=7.0.29
Apache Tomcat=7.0.30
Apache Tomcat=7.0.31
Apache Tomcat=7.0.32
Apache Tomcat=7.0.33
Apache Tomcat=7.0.34
Apache Tomcat=7.0.35
Apache Tomcat=7.0.36
Apache Tomcat=7.0.37
Apache Tomcat=7.0.38
Apache Tomcat=7.0.39
Apache Tomcat=7.0.40
Apache Tomcat=7.0.41
Apache Tomcat=7.0.42
Apache Tomcat=7.0.43
Apache Tomcat=7.0.44
Apache Tomcat=7.0.45
Apache Tomcat=7.0.46
Apache Tomcat=7.0.47
Apache Tomcat=7.0.48
Apache Tomcat=7.0.49
Apache Tomcat=7.0.50
Apache Tomcat=7.0.51
Apache Tomcat=7.0.54
Apache Tomcat=7.0.55
Apache Tomcat=7.0.56
Apache Tomcat=7.0.57
Apache Tomcat=7.0.58
Apache Tomcat=7.0.59
Apache Tomcat=7.0.60
Apache Tomcat=7.0.61
Apache Tomcat=7.0.62
Apache Tomcat=7.0.63
Apache Tomcat=7.0.64
Apache Tomcat=7.0.65
Apache Tomcat=7.0.66
Apache Tomcat=7.0.67
Apache Tomcat=7.0.68
Apache Tomcat=7.0.69
Apache Tomcat=7.0.70
Apache Tomcat=7.0.71
Apache Tomcat=7.0.72
Apache Tomcat=7.0.73
Apache Tomcat=7.0.74
Apache Tomcat=7.0.75
Apache Tomcat=7.0.76
Apache Tomcat=7.0.77
Apache Tomcat=7.0.79
Apache Tomcat=7.0.80
Apache Tomcat=7.0.81
Apache Tomcat=8.0.0-rc1
Apache Tomcat=8.0.0-rc10
Apache Tomcat=8.0.0-rc2
Apache Tomcat=8.0.0-rc5
Apache Tomcat=8.0.1
Apache Tomcat=8.0.2
Apache Tomcat=8.0.4
Apache Tomcat=8.0.6
Apache Tomcat=8.0.7
Apache Tomcat=8.0.9
Apache Tomcat=8.0.10
Apache Tomcat=8.0.11
Apache Tomcat=8.0.12
Apache Tomcat=8.0.13
Apache Tomcat=8.0.14
Apache Tomcat=8.0.15
Apache Tomcat=8.0.16
Apache Tomcat=8.0.17
Apache Tomcat=8.0.18
Apache Tomcat=8.0.19
Apache Tomcat=8.0.20
Apache Tomcat=8.0.21
Apache Tomcat=8.0.22
Apache Tomcat=8.0.23
Apache Tomcat=8.0.24
Apache Tomcat=8.0.25
Apache Tomcat=8.0.26
Apache Tomcat=8.0.27
Apache Tomcat=8.0.28
Apache Tomcat=8.0.29
Apache Tomcat=8.0.30
Apache Tomcat=8.0.31
Apache Tomcat=8.0.32
Apache Tomcat=8.0.33
Apache Tomcat=8.0.34
Apache Tomcat=8.0.35
Apache Tomcat=8.0.36
Apache Tomcat=8.0.37
Apache Tomcat=8.0.38
Apache Tomcat=8.0.39
Apache Tomcat=8.0.40
Apache Tomcat=8.0.41
Apache Tomcat=8.0.42
Apache Tomcat=8.0.43
Apache Tomcat=8.0.44
Apache Tomcat=8.0.45
Apache Tomcat=8.0.46
Apache Tomcat=8.5.0
Apache Tomcat=8.5.1
Apache Tomcat=8.5.2
Apache Tomcat=8.5.3
Apache Tomcat=8.5.4
Apache Tomcat=8.5.5
Apache Tomcat=8.5.6
Apache Tomcat=8.5.7
Apache Tomcat=8.5.8
Apache Tomcat=8.5.9
Apache Tomcat=8.5.10
Apache Tomcat=8.5.11
Apache Tomcat=8.5.12
Apache Tomcat=8.5.13
Apache Tomcat=8.5.14
Apache Tomcat=8.5.15
Apache Tomcat=8.5.16
Apache Tomcat=8.5.17
Apache Tomcat=8.5.18
Apache Tomcat=8.5.19
Apache Tomcat=8.5.20
Apache Tomcat=8.5.21
Apache Tomcat=8.5.22
Apache Tomcat=9.0.0
Apache Tomcat=9.0.0-m1
Apache Tomcat=9.0.0-m10
Apache Tomcat=9.0.0-m11
Apache Tomcat=9.0.0-m12
Apache Tomcat=9.0.0-m13
Apache Tomcat=9.0.0-m14
Apache Tomcat=9.0.0-m15
Apache Tomcat=9.0.0-m16
Apache Tomcat=9.0.0-m17
Apache Tomcat=9.0.0-m18
Apache Tomcat=9.0.0-m19
Apache Tomcat=9.0.0-m2
Apache Tomcat=9.0.0-m20
Apache Tomcat=9.0.0-m21
Apache Tomcat=9.0.0-m22
Apache Tomcat=9.0.0-m3
Apache Tomcat=9.0.0-m4
Apache Tomcat=9.0.0-m5
Apache Tomcat=9.0.0-m6
Apache Tomcat=9.0.0-m7
Apache Tomcat=9.0.0-m8
Apache Tomcat=9.0.0-m9
Apache Tomcat>=7.0.0<7.0.82
Apache Tomcat>=8.0<8.0.47
Apache Tomcat>=8.5.0<8.5.23
Apache Tomcat>=9.0.0<9.0.1
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=17.10
Canonical Ubuntu Linux=18.04
Oracle Agile PLM=9.3.3
Oracle Agile PLM=9.3.4
Oracle Agile PLM=9.3.5
Oracle Agile PLM=9.3.6
Oracle Communications Instant Messaging Server=10.0.1
Oracle Endeca Information Discovery Integrator=3.1.0
Oracle Endeca Information Discovery Integrator=3.2.0
Oracle Enterprise Manager For Mysql Database=12.1.0.4.0
Oracle Financial Services Analytical Applications Infrastructure>=7.3.3.0.0<=7.3.5.3.0
Oracle Financial Services Analytical Applications Infrastructure>=8.0.0.0.0<=8.0.9.0.0
Oracle Fmw Platform=12.2.1.2.0
Oracle Fmw Platform=12.2.1.3.0
Oracle Health Sciences Empirica Inspections=1.0.1.1
Oracle Hospitality Guest Access=4.2.0
Oracle Hospitality Guest Access=4.2.1
Oracle Instantis Enterprisetrack=17.1
Oracle Instantis Enterprisetrack=17.2
Oracle Management Pack Goldengate=11.2.1.0.13
Oracle MICROS Lucas=2.9.5
Oracle Micros Retail Xbri Loss Prevention=10.0.1
Oracle Micros Retail Xbri Loss Prevention=10.5.0
Oracle Micros Retail Xbri Loss Prevention=10.6.0
Oracle Micros Retail Xbri Loss Prevention=10.7.0
Oracle Micros Retail Xbri Loss Prevention=10.8.0
Oracle Micros Retail Xbri Loss Prevention=10.8.1
Oracle MySQL Enterprise Monitor<=3.3.6.3293
Oracle MySQL Enterprise Monitor>=3.4.0<=3.4.4.4226
Oracle MySQL Enterprise Monitor>=4.0.0<=4.0.0.5135
Oracle Retail Advanced Inventory Planning=13.2
Oracle Retail Advanced Inventory Planning=13.4
Oracle Retail Advanced Inventory Planning=14.1
Oracle Retail Advanced Inventory Planning=15.0
Oracle Retail Back Office=14.0.4
Oracle Retail Back Office=14.1.3
Oracle Retail Central Office=14.0.4
Oracle Retail Central Office=14.1.3
Oracle Retail Convenience And Fuel Pos Software=2.1.132
Oracle Retail EFTLink=1.1.124
Oracle Retail EFTLink=15.0.1
Oracle Retail EFTLink=16.0.2
Oracle Retail Insights=14.0
Oracle Retail Insights=14.1
Oracle Retail Insights=15.0
Oracle Retail Insights=16.0
Oracle Retail Invoice Matching=12.0
Oracle Retail Invoice Matching=13.0
Oracle Retail Invoice Matching=13.1
Oracle Retail Invoice Matching=13.2
Oracle Retail Invoice Matching=14.0
Oracle Retail Invoice Matching=14.1
Oracle Retail Invoice Matching=15.0
Oracle Retail Invoice Matching=16.0
Oracle Retail Order Broker=5.0
Oracle Retail Order Broker=5.1
Oracle Retail Order Broker=5.2
Oracle Retail Order Broker=15.0
Oracle Retail Order Broker=16.0
Oracle Retail Order Management System=4.0
Oracle Retail Order Management System=4.5
Oracle Retail Order Management System=4.7
Oracle Retail Order Management System=5.0
Oracle Retail Point-of-Service=14.0.4
Oracle Retail Point-of-Service=14.1.3
Oracle Retail Price Management=12.0
Oracle Retail Price Management=13.0
Oracle Retail Price Management=13.1
Oracle Retail Price Management=13.2
Oracle Retail Price Management=14.0
Oracle Retail Price Management=14.1
Oracle Retail Price Management=15.0
Oracle Retail Price Management=16.0
Oracle Retail Returns Management=2.3.8
Oracle Retail Returns Management=2.4.9
Oracle Retail Returns Management=14.0.4
Oracle Retail Returns Management=14.1.3
Oracle Retail Store Inventory Management=12.0.12
Oracle Retail Store Inventory Management=13.0.7
Oracle Retail Store Inventory Management=13.1.9
Oracle Retail Store Inventory Management=13.2.9
Oracle Retail Store Inventory Management=14.0.4
Oracle Retail Store Inventory Management=14.1.3
Oracle Retail Store Inventory Management=15.0.2
Oracle Retail Store Inventory Management=16.0.1
Oracle Retail Xstore Point of Service=6.0.11
Oracle Retail Xstore Point of Service=7.0.6
Oracle Retail Xstore Point of Service=7.1.6
Oracle Retail Xstore Point of Service=15.0.1
Oracle Transportation Management=6.3.1
Oracle Transportation Management=6.3.2
Oracle Transportation Management=6.3.3
Oracle Transportation Management=6.3.4
Oracle Transportation Management=6.3.5
Oracle Transportation Management=6.3.6
Oracle Transportation Management=6.3.7
Oracle Tuxedo System And Applications Monitor=12.1.3.0.0
Oracle WebCenter Sites=11.1.1.8.0
Oracle Workload Manager=12.2.0.1
Debian Debian Linux=7.0
NetApp Active Iq Unified Manager Windows>=7.3
NetApp Active Iq Unified Manager Vmware Vsphere>=9.5
NetApp OnCommand Balance
NetApp OnCommand Insight
NetApp Oncommand Shift
NetApp OnCommand Workflow Automation
NetApp Snapcenter
NetApp Element Vcenter Server
redhat Fuse=1.0
redhat JBoss Enterprise Application Platform=6.0.0
redhat JBoss Enterprise Application Platform=6.4.0
redhat Jboss Enterprise Web Server=2.0.0
redhat Jboss Enterprise Web Server=3.0.0
redhat Jboss Enterprise Web Server Text-only Advisories
redhat Enterprise Linux Desktop=6.0
redhat Enterprise Linux Desktop=7.0
redhat Enterprise Linux Eus=7.4
redhat Enterprise Linux Eus=7.5
redhat Enterprise Linux Eus=7.6
redhat Enterprise Linux Eus=7.7
redhat Enterprise Linux Eus Compute Node=7.4
redhat Enterprise Linux Eus Compute Node=7.5
redhat Enterprise Linux Eus Compute Node=7.6
redhat Enterprise Linux Eus Compute Node=7.7
redhat Enterprise Linux For Ibm Z Systems=6.0_s390x
redhat Enterprise Linux For Ibm Z Systems=7.0_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=7.4_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=7.5_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=7.6_s390x
redhat Enterprise Linux For Ibm Z Systems Eus=7.7_s390x
redhat Enterprise Linux For Power Big Endian=6.0_ppc64
redhat Enterprise Linux For Power Big Endian=7.0_ppc64
redhat Enterprise Linux For Power Big Endian Eus=7.4_ppc64
redhat Enterprise Linux For Power Big Endian Eus=7.5_ppc64
redhat Enterprise Linux For Power Big Endian Eus=7.6_ppc64
redhat Enterprise Linux For Power Big Endian Eus=7.7_ppc64
redhat Enterprise Linux For Power Little Endian=7.0
redhat Enterprise Linux For Power Little Endian Eus=7.4_ppc64le
redhat Enterprise Linux For Power Little Endian Eus=7.5_ppc64le
redhat Enterprise Linux For Power Little Endian Eus=7.6_ppc64le
redhat Enterprise Linux For Power Little Endian Eus=7.7_ppc64le
redhat Enterprise Linux Server=6.0
redhat Enterprise Linux Server=7.0
redhat Enterprise Linux Server Aus=7.4
redhat Enterprise Linux Server Aus=7.6
redhat Enterprise Linux Server Aus=7.7
redhat Enterprise Linux Server Tus=7.4
redhat Enterprise Linux Server Tus=7.6
redhat Enterprise Linux Server Tus=7.7
redhat Enterprise Linux Workstation=6.0
redhat Enterprise Linux Workstation=7.0
redhat/tomcat<7.0.82
7.0.82
redhat/tomcat<8.0.47
8.0.47
redhat/tomcat<8.5.23
8.5.23

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/tomcat to a version that resolves this vulnerability.

    Fixed in 7.0.82
  2. Upgrade

    Upgrade redhat/tomcat to a version that resolves this vulnerability.

    Fixed in 8.0.47
  3. Upgrade

    Upgrade redhat/tomcat to a version that resolves this vulnerability.

    Fixed in 8.5.23
  4. Upgrade

    Upgrade maven/org.apache.tomcat:tomcat to a version that resolves this vulnerability.

    Fixed in 8.0.47
  5. Upgrade

    Upgrade maven/org.apache.tomcat:tomcat to a version that resolves this vulnerability.

    Fixed in 7.0.82
  6. Upgrade

    Upgrade maven/org.apache.tomcat:tomcat to a version that resolves this vulnerability.

    Fixed in 8.5.23
  7. Upgrade

    Upgrade maven/org.apache.tomcat:tomcat to a version that resolves this vulnerability.

    Fixed in 9.0.1

Event History

Sep 21, 2017
Data Sourced
via Red Hat·11:13 PM
DescriptionSeverityAffected Software
Oct 3, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
DescriptionWeakness
Oct 4, 2017
Data Sourced
via NVD·01:29 AM
RemedyDescriptionSeverityWeaknessAffected Software
Mar 25, 2022
Known Exploited
via CISA·12:00 AM
May 14, 2022
Advisory Published
via GitHub·01:07 AM
Sep 2, 2025
Data Sourced
via Ubuntu·12:06 AM
RemedyDescriptionSeverityAffected Software
Sep 18, 2025
Data Sourced
via Launchpad·12:09 AM
Description
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2017-12617?

The severity of CVE-2017-12617 is classified as critical due to the ability to upload JSP files and execute arbitrary code.

2

How do I fix CVE-2017-12617?

To fix CVE-2017-12617, upgrade Apache Tomcat to version 7.0.82, 8.0.47, 8.5.23, or 9.0.1, depending on your installed version.

3

Which versions of Apache Tomcat are affected by CVE-2017-12617?

Affected versions of Apache Tomcat include 7.0.0 to 7.0.81, 8.0.0.RC1 to 8.0.46, 8.5.0 to 8.5.22, and 9.0.0 up to 9.0.0.M1.

4

What type of vulnerability is CVE-2017-12617?

CVE-2017-12617 is a file upload vulnerability that allows for remote code execution.

5

Can I prevent CVE-2017-12617 by disabling HTTP PUT?

Disabling HTTP PUT can mitigate the risk of CVE-2017-12617; however, the recommended action is to update to a patched version.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203