{"id":"CVE-2017-12617","published":"2017-10-04T01:29:02Z","modified":"2026-08-25T16:28:27Z","title":"Apache Tomcat Remote Code Execution Vulnerability","vendor":"Apache","product":"Tomcat","tier":"core","eol":null,"description":{"text":"When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an unrestricted file upload in Apache Tomcat's Default servlet, which affects the 9.0, 8.5, 8.0 and 7.0 release lines within the listed version ranges. An unauthenticated remote attacker can exploit it over the network without user interaction, but only when HTTP PUT is enabled, for example by setting the Default servlet's readonly initialisation parameter to false, to upload a JSP file that the server then executes when requested.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:05:43Z"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99968,"percentile":0.99977,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-12617","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-04-17","exploitedFirstSeen":"2019-04-17","ransomware":false,"evidence":[{"url":"https://blog.talosintelligence.com/2019/04/seaturtle.html","date":"2019-04-17"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-25"},{"url":"https://info.greynoise.io/hubfs/resources/GreyNoise-How-Resurgent-Vulnerabilities-Jeopardize-Organizational-Security-Report.pdf","date":"2025-04-23"},{"url":"https://www.greynoise.io/blog/coordinated-cloud-based-scanning-operation-targets-75-known-exposure-points","date":"2025-05-27"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"}],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/100954","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039552","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3080","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3081","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3113","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3114","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0268","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0269","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0270","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0271","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0275","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0465","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0466","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2939","tags":["Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb%40%3Cannounce.tomcat.apache.org%3E","tags":["Issue Tracking","Mailing List"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00009.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20171018-0002/","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20180117-0002/","tags":["Third Party Advisory"]},{"url":"https://support.f5.com/csp/article/K53173544","tags":["Third Party Advisory"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03812en_us","tags":["Third Party Advisory"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3665-1/","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/42966/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/43008/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/100954","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039552","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3080","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3081","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3113","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3114","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0268","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0269","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0270","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0271","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0275","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0465","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0466","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2939","tags":["Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb%40%3Cannounce.tomcat.apache.org%3E","tags":["Issue Tracking","Mailing List"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00009.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20171018-0002/","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20180117-0002/","tags":["Third Party Advisory"]},{"url":"https://support.f5.com/csp/article/K53173544","tags":["Third Party Advisory"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03812en_us","tags":["Third Party Advisory"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/3665-1/","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/42966/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/43008/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12617","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote unauthenticated exploit of public-facing web server","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"it was possible to upload a JSP file to the server via a specially crafted request","start":224,"end":306}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Uploaded JSP enables server-side code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"any code it contained would be executed by the server","start":345,"end":398}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Uploaded JSP web shell persists on server","mappingType":"primary_impact","evidence":[{"from":"description","quote":"This JSP could then be requested and any code it contained would be executed by the server","start":308,"end":398}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-65ab06ae92274f14e50e","title":"DNS Hijacking Abuses Trust In Core Internet Service","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/seaturtle/","date":"2019-04-17","mentions":[{"quote":"CVE-2017-12617: RCE affecting Apache web servers running Tomcat","start":8905,"end":8968},{"quote":"RCE for Cisco switchesSID: 41909 - 41910CVE-2017-6736: Remote Code Exploit (RCE) for Cisco integrated Service Router 2811SID: 43424 - 43432CVE-2017-12617: RCE affecting Apache web servers running TomcatSID: 44531CVE-2018-0296: Directory traversal to gain unauthorized access to Cisco Adaptive Security","start":20294,"end":20595}]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","vulnerableRanges":[">=9.0.0.M1, <9.0.1",">=8.5.0, <8.5.23",">=8.0.0-RC1, <8.0.47",">=7.0.0, <7.0.82"],"patched":["9.0.1","8.5.23","8.0.47","7.0.82"],"from":["GHSA-xjgh-84hx-56c5"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=9.0.0.M1, <9.0.1",">=8.5.0, <8.5.23",">=8.0.0-RC1, <8.0.47",">=7.0.0, <7.0.82"],"patched":["9.0.1","8.5.23","8.0.47","7.0.82"],"from":["GHSA-xjgh-84hx-56c5"],"provenance":"source"}],"advisories":[{"id":"GHSA-xjgh-84hx-56c5","url":"https://github.com/advisories/GHSA-xjgh-84hx-56c5","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","vulnerableRanges":[">=9.0.0.M1, <9.0.1"],"patched":["9.0.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-xjgh-84hx-56c5","url":"https://github.com/advisories/GHSA-xjgh-84hx-56c5","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","vulnerableRanges":[">=8.5.0, <8.5.23"],"patched":["8.5.23"],"provenance":"source","from":"GHSA"},{"id":"GHSA-xjgh-84hx-56c5","url":"https://github.com/advisories/GHSA-xjgh-84hx-56c5","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","vulnerableRanges":[">=8.0.0-RC1, <8.0.47"],"patched":["8.0.47"],"provenance":"source","from":"GHSA"},{"id":"GHSA-xjgh-84hx-56c5","url":"https://github.com/advisories/GHSA-xjgh-84hx-56c5","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","vulnerableRanges":[">=7.0.0, <7.0.82"],"patched":["7.0.82"],"provenance":"source","from":"GHSA"},{"id":"GHSA-xjgh-84hx-56c5","url":"https://github.com/advisories/GHSA-xjgh-84hx-56c5","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=9.0.0.M1, <9.0.1"],"patched":["9.0.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-xjgh-84hx-56c5","url":"https://github.com/advisories/GHSA-xjgh-84hx-56c5","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=8.5.0, <8.5.23"],"patched":["8.5.23"],"provenance":"source","from":"GHSA"},{"id":"GHSA-xjgh-84hx-56c5","url":"https://github.com/advisories/GHSA-xjgh-84hx-56c5","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=8.0.0-RC1, <8.0.47"],"patched":["8.0.47"],"provenance":"source","from":"GHSA"},{"id":"GHSA-xjgh-84hx-56c5","url":"https://github.com/advisories/GHSA-xjgh-84hx-56c5","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=7.0.0, <7.0.82"],"patched":["7.0.82"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-5811","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5811","exploited":true,"exploitedSince":"2022-03-25","provenance":"source"},"exploits":[{"id":42966,"url":"https://www.exploit-db.com/exploits/42966","title":"Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (2)","type":"webapps","platform":"jsp","date":"2017-10-09","verified":true,"provenance":"source"},{"id":43008,"url":"https://www.exploit-db.com/exploits/43008","title":"Tomcat - Remote Code Execution via JSP Upload Bypass (Metasploit)","type":"remote","platform":"java","date":"2017-10-17","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2017-10-09"},"pocGithub":{"count":8,"skipped":2,"earliest":"2017-10-05","earliestUrl":"https://github.com/cyberheartmi9/CVE-2017-12617","repos":[{"name":"cyberheartmi9/CVE-2017-12617","url":"https://github.com/cyberheartmi9/CVE-2017-12617","stars":400,"created":"2017-10-05"},{"name":"LongWayHomie/CVE-2017-12617","url":"https://github.com/LongWayHomie/CVE-2017-12617","stars":6,"created":"2021-12-10"},{"name":"ygouzerh/CVE-2017-12617","url":"https://github.com/ygouzerh/CVE-2017-12617","stars":2,"created":"2019-01-14"},{"name":"tyranteye666/tomcat-cve-2017-12617","url":"https://github.com/tyranteye666/tomcat-cve-2017-12617","stars":1,"created":"2021-02-04"},{"name":"jptr218/tc_hack","url":"https://github.com/jptr218/tc_hack","stars":1,"created":"2021-07-27"}]},"metasploit":[{"name":"Tomcat RCE via JSP Upload Bypass","module":"exploit/multi/http/tomcat_jsp_upload_bypass","type":"exploit","disclosureDate":"2017-10-03","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_jsp_upload_bypass.rb"}],"nuclei":[{"id":"CVE-2017-12617","name":"Apache Tomcat - Remote Code Execution","severity":"high","path":"http/cves/2017/CVE-2017-12617.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12617.yaml"}],"first":{"date":"2017-10-03","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_jsp_upload_bypass.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/42966/","https://www.exploit-db.com/exploits/43008/","https://www.exploit-db.com/exploits/42966","https://www.exploit-db.com/exploits/43008"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059","T1505.003"],"provenance":"ai"}],"timeline":[{"date":"2017-10-03","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2017-10-05, Exploit-DB 2017-10-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_jsp_upload_bypass.rb","provenance":"source"},{"date":"2017-10-04","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12617","provenance":"source"},{"date":"2019-04-17","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.talosintelligence.com/2019/04/seaturtle.html","provenance":"source"},{"date":"2019-04-17","kind":"report","label":"Named in blog.talosintelligence.com: DNS Hijacking Abuses Trust In Core Internet Service","url":"https://blog.talosintelligence.com/seaturtle/","provenance":"machine"},{"date":"2022-03-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5811","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":1633},"priority":{"score":72.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2753 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9998"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 2 Exploit-DB entries; 2 advisory exploit references; 8 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-tomcat-cve-2017-12615","children":[{"from":"CVE-2017-12617","to":"CVE-2021-24122","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/catalina/webresources/AbstractFileResourceSet.java"],"commits":["https://github.com/apache/tomcat/commit/a9dd96046d7acb0357c6b7b9e6cc70d186fae663","https://github.com/apache/tomcat/commit/74ad0e216c791454a318c1811300469eedc5c6f3","https://github.com/apache/tomcat/commit/7f004ac4531c45f9a2a2d1470561fe135cf27bc2","https://github.com/apache/tomcat/commit/800b03140e640f8892f27021e681645e8e320177"],"basis":"shared function","functions":["file","isInvalidWindowsFilename"]}]}],"packageHistory":[{"cve":"CVE-2017-12615","published":"2017-09-19","fixed":"7.0.79","kev":true,"link":{"from":"CVE-2017-12615","to":"CVE-2017-12617","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"7.0.79","toFixed":"7.0.82","daysApart":15},{"kind":"similar","provenance":"machine","score":0.93,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2014-0095","published":"2014-05-31","fixed":"8.0.4","kev":false},{"cve":"CVE-2017-5648","published":"2017-04-17","fixed":"9.0.0.M18","kev":false,"link":{"from":"CVE-2017-5648","to":"CVE-2017-12617","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"8.0.42","toFixed":"8.0.47","daysApart":170},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-catalina","fromFixed":"9.0.0.M18","toFixed":"9.0.1","daysApart":170}]}},{"cve":"CVE-2017-5651","published":"2017-04-17","fixed":"9.0.0.M19","kev":false,"link":{"from":"CVE-2017-5651","to":"CVE-2017-12617","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"8.5.13","toFixed":"8.5.23","daysApart":170},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"9.0.0.M19","toFixed":"9.0.1","daysApart":170}]}},{"cve":"CVE-2017-12617","published":"2017-10-04","fixed":"9.0.1","kev":true},{"cve":"CVE-2018-1304","published":"2018-02-28","fixed":"9.0.5","kev":false,"link":{"from":"CVE-2017-12617","to":"CVE-2018-1304","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"8.5.23","toFixed":"8.5.28","daysApart":147},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"9.0.1","toFixed":"9.0.5","daysApart":147}]}},{"cve":"CVE-2018-1305","published":"2018-02-23","fixed":"9.0.5","kev":false,"link":{"from":"CVE-2017-12617","to":"CVE-2018-1305","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"8.5.23","toFixed":"8.5.28","daysApart":142},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"9.0.1","toFixed":"9.0.5","daysApart":142}]}},{"cve":"CVE-2018-1336","published":"2018-08-02","fixed":"9.0.8","kev":false,"link":{"from":"CVE-2017-12617","to":"CVE-2018-1336","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"8.0.47","toFixed":"8.0.51","daysApart":302}]}},{"cve":"CVE-2019-0221","published":"2019-05-28","fixed":"9.0.17","kev":false,"link":{"from":"CVE-2017-12617","to":"CVE-2019-0221","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-catalina","fromFixed":"9.0.1","toFixed":"9.0.17","daysApart":601},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-catalina","fromFixed":"7.0.82","toFixed":"7.0.94","daysApart":601}]}}],"package":"Maven:org.apache.tomcat.embed:tomcat-embed-core"}}