Russian Vulnerability Scanner Database

Back to List

CVE-2017-12617

Scores

EPSS

0.944high94.4%
0%20%40%60%80%100%

Percentile: 94.4%

CVSS

8.1high3.x
0246810

CVSS Score: 8.1/10

All CVSS Scores

CVSS 3.x
8.1

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0
6.8

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Description

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

debiannvdredhatubuntu

CWEs

CWE-20CWE-434

Related Vulnerabilities

BDU:2023-01045

Exploits

Exploit ID: 42966

Source: exploitdb

URL: https://www.exploit-db.com/exploits/42966

Exploit ID: 43008

Source: exploitdb

URL: https://www.exploit-db.com/exploits/43008

Exploit ID: CVE-2017-12617

Source: github-poc

URL: https://github.com/DevaDJ/CVE-2017-12617

Recommendations

Source: nvd

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

URL: https://access.redhat.com/errata/RHSA-2017:3081

Source: nvd

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

URL: https://access.redhat.com/errata/RHSA-2017:3080

Vulnerable Software (322)

Type: Configuration

Product: hornetq

Operating System: rhel

Trait: 
{  "fixed": "2.3.25-25.SP23_redhat_1.1.ep6.el5"}

Source: redhat

Type: Configuration

Product: hornetq

Operating System: rhel

Trait: 
{  "fixed": "2.3.25-25.SP23_redhat_1.1.ep6.el6"}

Source: redhat

Type: Configuration

Product: hornetq

Operating System: rhel

Trait: 
{  "fixed": "2.3.25-25.SP23_redhat_1.1.ep6.el7"}

Source: redhat

Type: Configuration

Product: httpd

Operating System: rhel

Trait: 
{  "fixed": "2.2.26-57.ep6.el6"}

Source: redhat

Type: Configuration

Product: httpd22

Operating System: rhel

Trait: 
{  "fixed": "2.2.26-58.ep6.el7"}

Source: redhat

Type: Configuration

Product: infinispan

Operating System: rhel

Trait: 
{  "fixed": "5.2.23-1.Final_redhat_1.1.ep6.el5"}

Source: redhat

Type: Configuration

Product: infinispan

Operating System: rhel

Trait: 
{  "fixed": "5.2.23-1.Final_redhat_1.1.ep6.el6"}

Source: redhat

Type: Configuration

Product: infinispan

Operating System: rhel

Trait: 
{  "fixed": "5.2.23-1.Final_redhat_1.1.ep6.el7"}

Source: redhat

Type: Configuration

Product: ironjacamar-eap6

Operating System: rhel

Trait: 
{  "fixed": "1.0.41-1.Final_redhat_1.1.ep6.el5"}

Source: redhat

Type: Configuration

Product: ironjacamar-eap6

Operating System: rhel

Trait: 
{  "fixed": "1.0.41-1.Final_redhat_1.1.ep6.el6"}

Source: redhat

Type: Configuration

Product: ironjacamar-eap6

Operating System: rhel

Trait: 
{  "fixed": "1.0.41-1.Final_redhat_1.1.ep6.el7"}

Source: redhat

Type: Configuration

Product: jbcs-httpd24-openssl

Operating System: rhel

Trait: 
{  "fixed": "1.0.2h-14.jbcs.el6"}

Source: redhat

Type: Configuration

Product: jbcs-httpd24-openssl

Operating System: rhel

Trait: 
{  "fixed": "1.0.2h-14.jbcs.el7"}

Source: redhat

Type: Configuration

Product: jboss-as-appclient

Operating System: rhel

Trait: 
{  "fixed": "7.5.19-2.Final_redhat_2.1.ep6.el5"}

Source: redhat

Type: Configuration

Product: jboss-as-appclient

Operating System: rhel

Trait: 
{  "fixed": "7.5.19-2.Final_redhat_2.1.ep6.el6"}

Source: redhat

Type: Configuration

Product: jboss-as-appclient

Operating System: rhel

Trait: 
{  "fixed": "7.5.19-2.Final_redhat_2.1.ep6.el7"}

Source: redhat

Type: Configuration

Product: jboss-as-cli

Operating System: rhel

Trait: 
{  "fixed": "7.5.19-2.Final_redhat_2.1.ep6.el5"}

Source: redhat

Type: Configuration

Product: jboss-as-cli

Operating System: rhel

Trait: 
{  "fixed": "7.5.19-2.Final_redhat_2.1.ep6.el6"}

Source: redhat

Type: Configuration

Product: jboss-as-cli

Operating System: rhel

Trait: 
{  "fixed": "7.5.19-2.Final_redhat_2.1.ep6.el7"}

Source: redhat

Type: Configuration

Product: jboss-as-client-all

Operating System: rhel

Trait: 
{  "fixed": "7.5.19-2.Final_redhat_2.1.ep6.el7"}

Source: redhat