CVE-2017-12617

Warnung

Exploit

EPSS 99.99%
Veröffentlicht 04.10.2017 01:29:02
Zuletzt bearbeitet 25.08.2026 16:28:27
Erkennungen
Login

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Betroffene Produkte Warnungen 1 Metriken 4 CWE 1 Referenzen 48

NVD 157 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apache ≫ Tomcat Version >= 7.0.0 < 7.0.82

Apache ≫ Tomcat Version >= 8.0 < 8.0.47

Apache ≫ Tomcat Version >= 8.5.0 < 8.5.23

Apache ≫ Tomcat Version >= 9.0.0 < 9.0.1

Canonical ≫ Ubuntu Linux Version 12.04 SwEdition esm

Canonical ≫ Ubuntu Linux Version 16.04 SwEdition esm

Canonical ≫ Ubuntu Linux Version 17.10

Canonical ≫ Ubuntu Linux Version 18.04 SwEdition esm

Oracle ≫ Agile Product Lifecycle Management Version 9.3.3

Oracle ≫ Agile Product Lifecycle Management Version 9.3.4

Oracle ≫ Agile Product Lifecycle Management Version 9.3.5

Oracle ≫ Agile Product Lifecycle Management Version 9.3.6

Oracle ≫ Communications Instant Messaging Server Version 10.0.1

Oracle ≫ Endeca Information Discovery Integrator Version 3.1.0

Oracle ≫ Endeca Information Discovery Integrator Version 3.2.0

Oracle ≫ Enterprise Manager For Mysql Database Version 12.1.0.4.0

Oracle ≫ Financial Services Analytical Applications Infrastructure Version >= 7.3.3.0.0 <= 7.3.5.3.0

Oracle ≫ Financial Services Analytical Applications Infrastructure Version >= 8.0.0.0.0 <= 8.0.9.0.0

Oracle ≫ Fmw Platform Version 12.2.1.2.0

Oracle ≫ Fmw Platform Version 12.2.1.3.0

Oracle ≫ Health Sciences Empirica Inspections Version 1.0.1.1

Oracle ≫ Hospitality Guest Access Version 4.2.0

Oracle ≫ Hospitality Guest Access Version 4.2.1

Oracle ≫ Instantis Enterprisetrack Version 17.1

Oracle ≫ Instantis Enterprisetrack Version 17.2

Oracle ≫ Management Pack Version 11.2.1.0.13 SwPlatform goldengate

Oracle ≫ Micros Lucas Version 2.9.5

Oracle ≫ Micros Retail Xbri Loss Prevention Version 10.0.1

Oracle ≫ Micros Retail Xbri Loss Prevention Version 10.5.0

Oracle ≫ Micros Retail Xbri Loss Prevention Version 10.6.0

Oracle ≫ Micros Retail Xbri Loss Prevention Version 10.7.0

Oracle ≫ Micros Retail Xbri Loss Prevention Version 10.8.0

Oracle ≫ Micros Retail Xbri Loss Prevention Version 10.8.1

Oracle ≫ Mysql Enterprise Monitor Version <= 3.3.6.3293

Oracle ≫ Mysql Enterprise Monitor Version >= 3.4.0 <= 3.4.4.4226

Oracle ≫ Mysql Enterprise Monitor Version >= 4.0.0 <= 4.0.0.5135

Oracle ≫ Retail Advanced Inventory Planning Version 13.2

Oracle ≫ Retail Advanced Inventory Planning Version 13.4

Oracle ≫ Retail Advanced Inventory Planning Version 14.1

Oracle ≫ Retail Advanced Inventory Planning Version 15.0

Oracle ≫ Retail Back Office Version 14.0.4

Oracle ≫ Retail Back Office Version 14.1.3

Oracle ≫ Retail Central Office Version 14.0.4

Oracle ≫ Retail Central Office Version 14.1.3

Oracle ≫ Retail Convenience And Fuel Pos Software Version 2.1.132

Oracle ≫ Retail Eftlink Version 1.1.124

Oracle ≫ Retail Eftlink Version 15.0.1

Oracle ≫ Retail Eftlink Version 16.0.2

Oracle ≫ Retail Insights Version 14.0

Oracle ≫ Retail Insights Version 14.1

Oracle ≫ Retail Insights Version 15.0

Oracle ≫ Retail Insights Version 16.0

Oracle ≫ Retail Invoice Matching Version 12.0

Oracle ≫ Retail Invoice Matching Version 13.0

Oracle ≫ Retail Invoice Matching Version 13.1

Oracle ≫ Retail Invoice Matching Version 13.2

Oracle ≫ Retail Invoice Matching Version 14.0

Oracle ≫ Retail Invoice Matching Version 14.1

Oracle ≫ Retail Invoice Matching Version 15.0

Oracle ≫ Retail Invoice Matching Version 16.0

Oracle ≫ Retail Order Broker Version 5.0

Oracle ≫ Retail Order Broker Version 5.1

Oracle ≫ Retail Order Broker Version 5.2

Oracle ≫ Retail Order Broker Version 15.0

Oracle ≫ Retail Order Broker Version 16.0

Oracle ≫ Retail Order Management System Version 4.0

Oracle ≫ Retail Order Management System Version 4.5

Oracle ≫ Retail Order Management System Version 4.7

Oracle ≫ Retail Order Management System Version 5.0

Oracle ≫ Retail Point-of-service Version 14.0.4

Oracle ≫ Retail Point-of-service Version 14.1.3

Oracle ≫ Retail Price Management Version 12.0

Oracle ≫ Retail Price Management Version 13.0

Oracle ≫ Retail Price Management Version 13.1

Oracle ≫ Retail Price Management Version 13.2

Oracle ≫ Retail Price Management Version 14.0

Oracle ≫ Retail Price Management Version 14.1

Oracle ≫ Retail Price Management Version 15.0

Oracle ≫ Retail Price Management Version 16.0

Oracle ≫ Retail Returns Management Version 2.3.8

Oracle ≫ Retail Returns Management Version 2.4.9

Oracle ≫ Retail Returns Management Version 14.0.4

Oracle ≫ Retail Returns Management Version 14.1.3

Oracle ≫ Retail Store Inventory Management Version 12.0.12

Oracle ≫ Retail Store Inventory Management Version 13.0.7

Oracle ≫ Retail Store Inventory Management Version 13.1.9

Oracle ≫ Retail Store Inventory Management Version 13.2.9

Oracle ≫ Retail Store Inventory Management Version 14.0.4

Oracle ≫ Retail Store Inventory Management Version 14.1.3

Oracle ≫ Retail Store Inventory Management Version 15.0.2

Oracle ≫ Retail Store Inventory Management Version 16.0.1

Oracle ≫ Retail Xstore Point Of Service Version 6.0.11

Oracle ≫ Retail Xstore Point Of Service Version 7.0.6

Oracle ≫ Retail Xstore Point Of Service Version 7.1.6

Oracle ≫ Retail Xstore Point Of Service Version 15.0.1

Oracle ≫ Transportation Management Version 6.3.1

Oracle ≫ Transportation Management Version 6.3.2

Oracle ≫ Transportation Management Version 6.3.3

Oracle ≫ Transportation Management Version 6.3.4

Oracle ≫ Transportation Management Version 6.3.5

Oracle ≫ Transportation Management Version 6.3.6

Oracle ≫ Transportation Management Version 6.3.7

Oracle ≫ Tuxedo System And Applications Monitor Version 12.1.3.0.0

Oracle ≫ Webcenter Sites Version 11.1.1.8.0

Oracle ≫ Workload Manager Version 12.2.0.1

Debian ≫ Debian Linux Version 7.0

Netapp ≫ Active Iq Unified Manager SwPlatform windows Version >= 7.3

Netapp ≫ Active Iq Unified Manager SwPlatform vmware_vsphere Version >= 9.5

Netapp ≫ Oncommand Balance Version -

Netapp ≫ Oncommand Insight Version -

Netapp ≫ Oncommand Shift Version -

Netapp ≫ Oncommand Workflow Automation Version -

Netapp ≫ Snapcenter Version -

Netapp ≫ Element Version - SwPlatform vcenter_server

Redhat ≫ Fuse Version 1.0

Redhat ≫ Jboss Enterprise Application Platform Version 6.0.0

Redhat ≫ Jboss Enterprise Application Platform Version 6.4.0

Redhat ≫ Jboss Enterprise Web Server Version 2.0.0

Redhat ≫ Jboss Enterprise Web Server Version 3.0.0

Redhat ≫ Jboss Enterprise Web Server Text-only Advisories Version -

Redhat ≫ Enterprise Linux Desktop Version 6.0

Redhat ≫ Enterprise Linux Desktop Version 7.0

Redhat ≫ Enterprise Linux Eus Version 7.4

Redhat ≫ Enterprise Linux Eus Version 7.5

Redhat ≫ Enterprise Linux Eus Version 7.6

Redhat ≫ Enterprise Linux Eus Version 7.7

Redhat ≫ Enterprise Linux Eus Compute Node Version 7.4

Redhat ≫ Enterprise Linux Eus Compute Node Version 7.5

Redhat ≫ Enterprise Linux Eus Compute Node Version 7.6

Redhat ≫ Enterprise Linux Eus Compute Node Version 7.7

Redhat ≫ Enterprise Linux For Ibm Z Systems Version 6.0_s390x

Redhat ≫ Enterprise Linux For Ibm Z Systems Version 7.0_s390x

Redhat ≫ Enterprise Linux For Ibm Z Systems Eus Version 7.4_s390x

Redhat ≫ Enterprise Linux For Ibm Z Systems Eus Version 7.5_s390x

Redhat ≫ Enterprise Linux For Ibm Z Systems Eus Version 7.6_s390x

Redhat ≫ Enterprise Linux For Ibm Z Systems Eus Version 7.7_s390x

Redhat ≫ Enterprise Linux For Power Big Endian Version 6.0_ppc64

Redhat ≫ Enterprise Linux For Power Big Endian Version 7.0_ppc64

Redhat ≫ Enterprise Linux For Power Big Endian Eus Version 7.4_ppc64

Redhat ≫ Enterprise Linux For Power Big Endian Eus Version 7.5_ppc64

Redhat ≫ Enterprise Linux For Power Big Endian Eus Version 7.6_ppc64

Redhat ≫ Enterprise Linux For Power Big Endian Eus Version 7.7_ppc64

Redhat ≫ Enterprise Linux For Power Little Endian Version 7.0

Redhat ≫ Enterprise Linux For Power Little Endian Eus Version 7.4_ppc64le

Redhat ≫ Enterprise Linux For Power Little Endian Eus Version 7.5_ppc64le

Redhat ≫ Enterprise Linux For Power Little Endian Eus Version 7.6_ppc64le

Redhat ≫ Enterprise Linux For Power Little Endian Eus Version 7.7_ppc64le

Redhat ≫ Enterprise Linux Server Version 6.0

Redhat ≫ Enterprise Linux Server Version 7.0

Redhat ≫ Enterprise Linux Server Aus Version 7.4

Redhat ≫ Enterprise Linux Server Aus Version 7.6

Redhat ≫ Enterprise Linux Server Aus Version 7.7

Redhat ≫ Enterprise Linux Server Tus Version 7.4

Redhat ≫ Enterprise Linux Server Tus Version 7.6

Redhat ≫ Enterprise Linux Server Tus Version 7.7

Redhat ≫ Enterprise Linux Workstation Version 6.0

Redhat ≫ Enterprise Linux Workstation Version 7.0

25.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Apache Tomcat Remote Code Execution Vulnerability

Schwachstelle

When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	99.99%	1

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	8.1	2.2	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P
CISA-ADP	8.1	2.2	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Patch

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Patch

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Patch

Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Patch

Third Party Advisory

https://usn.ubuntu.com/3665-1/

Third Party Advisory

http://www.securityfocus.com/bid/100954

Third Party Advisory

Broken Link

VDB Entry

http://www.securitytracker.com/id/1039552

Third Party Advisory

Broken Link

VDB Entry

https://lists.debian.org/debian-lts-announce/2017/11/msg00009.html

Third Party Advisory

Mailing List

https://security.netapp.com/advisory/ntap-20171018-0002/

Third Party Advisory

https://security.netapp.com/advisory/ntap-20180117-0002/

Third Party Advisory

https://www.exploit-db.com/exploits/42966/

Third Party Advisory

Exploit

VDB Entry

https://www.exploit-db.com/exploits/43008/

Third Party Advisory

Exploit

VDB Entry

https://access.redhat.com/errata/RHSA-2017:3080

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3081

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3113

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:3114

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0465

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0466

Third Party Advisory

https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E

Patch

Mailing List

https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E

Patch

Mailing List

https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E

Patch

Mailing List

https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E

Patch

Mailing List

https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E

Patch

Mailing List

https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E

Patch

Mailing List

https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E

Patch

Mailing List

https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E

Patch

Mailing List

https://access.redhat.com/errata/RHSA-2018:0268

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0269

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0270

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0271

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0275

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2939

Third Party Advisory

https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E

Patch

Mailing List

https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb%40%3Cannounce.tomcat.apache.org%3E

Mailing List

Issue Tracking

https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E

Patch

Mailing List

https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E

Patch

Mailing List

https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E

Patch

Mailing List

https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E

Patch

Mailing List

https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E

Patch

Mailing List

https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E

Patch

Mailing List

https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E

Patch

Mailing List

https://support.f5.com/csp/article/K53173544

Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03812en_us

Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us

Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12617

US Government Resource

https://nvd.nist.gov/vuln/detail/CVE-2017-12617

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2017-12617

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2017-12617

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2017-12617

25.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog