CVE-2017-12617
HighActively exploited (CISA KEV)
Description
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
SeverityHigh
CVSS8.1
Exploit probability—
Product
Apache Tomcat
PublishedOct 4, 2017
First seenOct 4, 2017
Added to KEVMar 25, 2022
Weakness typeCWE-434Unrestricted upload of dangerous file type
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: Apr 15, 2022Update
- apache tomcat7.0.82, 8.0.47, 8.5.23, 9.0.1 or later
- org.apache.tomcat:tomcat-catalina9.0.1, 8.5.23, 8.0.47, 7.0.82 or later
- org.apache.tomcat.embed:tomcat-embed-core9.0.1, 8.5.23, 8.0.47, 7.0.82 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2017:3113
- access.redhat.com/errata/RHSA-2017:3080
- access.redhat.com/errata/RHSA-2018:0269
- access.redhat.com/errata/RHSA-2018:0270
- access.redhat.com/errata/RHSA-2018:0271
- access.redhat.com/errata/RHSA-2018:2939
- access.redhat.com/errata/RHSA-2018:0465
- usn.ubuntu.com/3665-1/
- access.redhat.com/errata/RHSA-2018:0268
- access.redhat.com/errata/RHSA-2017:3114
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tomcat | 7.0.0 ≤ v < 7.0.82, 8.0 ≤ v < 8.0.47, 8.5.0 ≤ v < 8.5.23, 9.0.0 ≤ v < 9.0.1 | 7.0.82, 8.0.47, 8.5.23, 9.0.1 |
| canonical ubuntu_linux | 12.04, 16.04, 17.10, 18.04 | — |
| oracle agile_product_lifecycle_management | 9.3.3, 9.3.4, 9.3.5, 9.3.6 | — |
| oracle communications_instant_messaging_server | 10.0.1 | — |
| oracle endeca_information_discovery_integrator | 3.1.0, 3.2.0 | — |
| oracle enterprise_manager_for_mysql_database | 12.1.0.4.0 | — |
| oracle financial_services_analytical_applications_infrastructure | 7.3.3.0.0 ≤ v ≤ 7.3.5.3.0, 8.0.0.0.0 ≤ v ≤ 8.0.9.0.0 | — |
| oracle fmw_platform | 12.2.1.2.0, 12.2.1.3.0 | — |
| oracle health_sciences_empirica_inspections | 1.0.1.1 | — |
| oracle hospitality_guest_access | 4.2.0, 4.2.1 | — |
| oracle instantis_enterprisetrack | 17.1, 17.2 | — |
| oracle management_pack | 11.2.1.0.13 | — |
| oracle micros_lucas | 2.9.5 | — |
| oracle micros_retail_xbri_loss_prevention | 10.0.1, 10.5.0, 10.6.0, 10.7.0, 10.8.0, 10.8.1 | — |
| oracle mysql_enterprise_monitor | v ≤ 3.3.6.3293, 3.4.0 ≤ v ≤ 3.4.4.4226, 4.0.0 ≤ v ≤ 4.0.0.5135 | — |
| oracle retail_advanced_inventory_planning | 13.2, 13.4, 14.1, 15.0 | — |
| oracle retail_back_office | 14.0.4, 14.1.3 | — |
| oracle retail_central_office | 14.0.4, 14.1.3 | — |
| oracle retail_convenience_and_fuel_pos_software | 2.1.132 | — |
| oracle retail_eftlink | 1.1.124, 15.0.1, 16.0.2 | — |
| oracle retail_insights | 14.0, 14.1, 15.0, 16.0 | — |
| oracle retail_invoice_matching | 12.0, 13.0, 13.1, 13.2, 14.0, 14.1, 15.0, 16.0 | — |
| oracle retail_order_broker | 5.0, 5.1, 5.2, 15.0, 16.0 | — |
| oracle retail_order_management_system | 4.0, 4.5, 4.7, 5.0 | — |
| oracle retail_point-of-service | 14.0.4, 14.1.3 | — |
| oracle retail_price_management | 12.0, 13.0, 13.1, 13.2, 14.0, 14.1, 15.0, 16.0 | — |
| oracle retail_returns_management | 2.3.8, 2.4.9, 14.0.4, 14.1.3 | — |
| oracle retail_store_inventory_management | 12.0.12, 13.0.7, 13.1.9, 13.2.9, 14.0.4, 14.1.3, 15.0.2, 16.0.1 | — |
| oracle retail_xstore_point_of_service | 6.0.11, 7.0.6, 7.1.6, 15.0.1 | — |
| oracle transportation_management | 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7 | — |
| oracle tuxedo_system_and_applications_monitor | 12.1.3.0.0 | — |
| oracle webcenter_sites | 11.1.1.8.0 | — |
| oracle workload_manager | 12.2.0.1 | — |
| debian debian_linux | 7.0 | — |
| netapp active_iq_unified_manager | 7.3 ≤ v, 9.5 ≤ v | — |
| netapp oncommand_balance | No range specified | — |
| netapp oncommand_insight | No range specified | — |
| netapp oncommand_shift | No range specified | — |
| netapp oncommand_workflow_automation | No range specified | — |
| netapp snapcenter | No range specified | — |
| netapp element | No range specified | — |
| redhat fuse | 1.0 | — |
| redhat jboss_enterprise_application_platform | 6.0.0, 6.4.0 | — |
| redhat jboss_enterprise_web_server | 2.0.0, 3.0.0 | — |
| redhat jboss_enterprise_web_server_text-only_advisories | No range specified | — |
| redhat enterprise_linux_desktop | 6.0, 7.0 | — |
| redhat enterprise_linux_eus | 7.4, 7.5, 7.6, 7.7 | — |
| redhat enterprise_linux_eus_compute_node | 7.4, 7.5, 7.6, 7.7 | — |
| redhat enterprise_linux_for_ibm_z_systems | 6.0_s390x, 7.0_s390x | — |
| redhat enterprise_linux_for_ibm_z_systems_eus | 7.4_s390x, 7.5_s390x, 7.6_s390x, 7.7_s390x | — |
| redhat enterprise_linux_for_power_big_endian | 6.0_ppc64, 7.0_ppc64 | — |
| redhat enterprise_linux_for_power_big_endian_eus | 7.4_ppc64, 7.5_ppc64, 7.6_ppc64, 7.7_ppc64 | — |
| redhat enterprise_linux_for_power_little_endian | 7.0 | — |
| redhat enterprise_linux_for_power_little_endian_eus | 7.4_ppc64le, 7.5_ppc64le, 7.6_ppc64le, 7.7_ppc64le | — |
| redhat enterprise_linux_server | 6.0, 7.0 | — |
| redhat enterprise_linux_server_aus | 7.4, 7.6, 7.7 | — |
| redhat enterprise_linux_server_tus | 7.4, 7.6, 7.7 | — |
| redhat enterprise_linux_workstation | 6.0, 7.0 | — |
| org.apache.tomcat:tomcat-catalinaMaven | 9.0.0.M1 ≤ v < 9.0.1, 8.5.0 ≤ v < 8.5.23, 8.0.0-RC1 ≤ v < 8.0.47, 7.0.0 ≤ v < 7.0.82 | 9.0.1, 8.5.23, 8.0.47, 7.0.82 |
| org.apache.tomcat.embed:tomcat-embed-coreMaven | 9.0.0.M1 ≤ v < 9.0.1, 8.5.0 ≤ v < 8.5.23, 8.0.0-RC1 ≤ v < 8.0.47, 7.0.0 ≤ v < 7.0.82 | 9.0.1, 8.5.23, 8.0.47, 7.0.82 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.