CVE-2017-12617

Scores

EPSS

0.944High94.4%
0%20%40%60%80%100%

Percentile: 94.4%

CVSS

8.1High3.x
0246810

CVSS Score: 8.1/10

All CVSS Scores

CVSS 3.x
8.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0
6.8

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Description

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

debiannvdredhatubuntu

CWEs

CWE-20CWE-434

Related Vulnerabilities

Exploits

Exploit ID: 42966

Source: exploitdb

URL: https://www.exploit-db.com/exploits/42966

Exploit ID: 43008

Source: exploitdb

URL: https://www.exploit-db.com/exploits/43008

Exploit ID: CVE-2017-12617

Source: github-poc

URL: https://github.com/DevaDJ/CVE-2017-12617

Vulnerable Software (312)

Type: Configuration

Product: hornetq

Operating System: rhel

Trait:
{
  "fixed": "2.3.25-25.SP23_redhat_1.1.ep6.el7"
}

Source: redhat

Type: Configuration

Product: hornetq

Operating System: rhel

Trait:
{
  "fixed": "2.3.25-25.SP23_redhat_1.1.ep6.el6"
}

Source: redhat

Type: Configuration

Product: hornetq

Operating System: rhel

Trait:
{
  "fixed": "2.3.25-25.SP23_redhat_1.1.ep6.el5"
}

Source: redhat

Type: Configuration

Product: httpd

Operating System: rhel

Trait:
{
  "fixed": "2.2.26-57.ep6.el6"
}

Source: redhat

Type: Configuration

Product: httpd22

Operating System: rhel

Trait:
{
  "fixed": "2.2.26-58.ep6.el7"
}

Source: redhat

Type: Configuration

Product: infinispan

Operating System: rhel

Trait:
{
  "fixed": "5.2.23-1.Final_redhat_1.1.ep6.el7"
}

Source: redhat

Type: Configuration

Product: infinispan

Operating System: rhel

Trait:
{
  "fixed": "5.2.23-1.Final_redhat_1.1.ep6.el6"
}

Source: redhat

Type: Configuration

Product: infinispan

Operating System: rhel

Trait:
{
  "fixed": "5.2.23-1.Final_redhat_1.1.ep6.el5"
}

Source: redhat

Type: Configuration

Product: ironjacamar-eap6

Operating System: rhel

Trait:
{
  "fixed": "1.0.41-1.Final_redhat_1.1.ep6.el7"
}

Source: redhat

Type: Configuration

Product: ironjacamar-eap6

Operating System: rhel

Trait:
{
  "fixed": "1.0.41-1.Final_redhat_1.1.ep6.el6"
}

Source: redhat