CVE-2017-12615 Apache Tomcat
| Affected software | Apache Tomcat |
|---|---|
| Severity | 8.1 High CVSS 3.1 3 scores |
| Fixed in | 7.0.79 |
| Weakness | Unrestricted file upload (CWE-434) |
| Published | 19 Sep 2017 |
| Updated | 13 Nov 2026 |
Description
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2022-03-25 · remediation due 2022-04-15 · ransomware use: known
- VulnCheck KEV listed Exploitation reported in the wild. 10 citations · honeypot sightings · 13 exploits · earliest 2019-01-08.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: total.
- Indexed PoC 19 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Nuclei; first seen 2017-09-20.
- EPSS 99.7% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2017-12615 in VulnCheck (free account), which lists 5 more citations and 8 more exploit references not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | Shadowserver honeypots | Exploitation attempts seen on 181 days | 2023-12-25 to 2026-11-11 |
| Honeypot sighting | VulnCheck canaries | Exploitation attempts seen on 8 days | 2026-11-01 to 2026-11-13 |
| Reported exploitation | lacework.com | /blog/elf-of-the-month-new-lucky-ransomware-sample | 2019-01-08 |
| Reported exploitation | alibabacloud.com | /blog/threat-alert-multiple-cryptocurrency-miner-botnets-start-to-exploit-the-new-thinkphp-vulnerability_594369 | 2019-01-13 |
| Reported exploitation | fortinet.com | /blog/threat-research/closer-look-satan-ransomwares-propagation-technics | 2019-05-20 |
| Reported exploitation | trendmicro.com | /en_us/research/19/f/blacksquid-slithers-into-servers-and-drives-with-8-notorious-exploits-to-drop-xmrig-miner.html | 2019-06-03 |
| Reported exploitation | s.tencent.com | /research/report/737.html | 2019-06-11 |
| Exploit reference | VulnCheck XDB 5a1624c6df1b | Exploit type: initial-access | 2017-09-23 |
| Exploit reference | VulnCheck XDB 3e4c49fc05be | Exploit type: initial-access | 2017-09-25 |
| Exploit reference | VulnCheck XDB 8d7305eb7051 | Exploit type: initial-access | 2017-10-06 |
| Exploit reference | VulnCheck XDB b6f4790733ea | Exploit type: initial-access | 2017-11-01 |
| Exploit reference | VulnCheck XDB 6889df0c7813 | Exploit type: initial-access | 2020-10-07 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | tomcat自动化漏洞扫描利用工具，支持批量弱口令检测、后台部署war包getshell、CVE-2017-12615 文件上传、CVE-2020-1938/CNVD-2020-10487 文件包含 | 300 | 2024-08-29 |
| Nuclei | Apache Tomcat Servers - Remote Code Execution | ||
| Exploit-DB | Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1) | 2017-09-20 | |
| GitHub PoC | Tomcat常见漏洞GUI利用工具。CVE-2017-12615 PUT文件上传漏洞、tomcat-pass-getshell 弱认证部署war包、弱口令爆破、CVE-2020-1938 Tomcat AJP文件读取/包含 | 259 | 2022-11-13 |
| GitHub PoC | POC Exploit for Apache Tomcat 7.0.x CVE-2017-12615 PUT JSP vulnerability. | 112 | 2017-09-23 |
| GitHub PoC | Tomcat PUT方法任意文件写入（CVE-2017-12615）exp | 11 | 2023-03-10 |
| GitHub PoC | just a python script for cve-2017-12615 | 10 | 2017-09-25 |
| GitHub PoC | CVE-2017-12617 and CVE-2017-12615 for tomcat server | 6 | 2017-10-06 |
| GitHub PoC | CVE-2017-12615 Tomcat RCE (TESTED) | 4 | 2017-12-26 |
| GitHub PoC | tomcat-put-cve-2017-12615 | 3 | 2017-11-01 |
Waratek protection
Waratek has a rule that blocks the main way to exploit this vulnerability, but a public exploit or tool gets past it.
- Protection partial Process, Filesystem
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE partially protected by the ARMR Process rule, ARMR Filesystem Write: a public exploit or tool reaches the rated impact without tripping it. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: ARMR Process rule, ARMR Filesystem Write
Tomcat PUT .jsp/ upload bypass → JSP webshell (CWE-434); blocks webshell commands that start a program. (partial coverage: the upload itself, and a webshell that reads or copies out data directly in Java, are not stopped).
Same vulnerability class as CVE-2017-12617 (12615 is the original PUT upload flaw; 12617 is the bypass of its fix).
The Configuration Aspect: Tomcat’s default setting keeps the readonly initialization parameter set to true on its DefaultServlet, which blocks arbitrary file uploads. For CVE-2017-12615 to be exposed, an administrator must explicitly change readonly to false in web.xml (or manually enable HTTP PUT requests).
For some Application it is possible to define a filesystem write rule with input(http) on webapp *.jsp paths which will block the upload itself.
How to mitigate CVE-2017-12615
Upgrade Apache Tomcat to 7.0.79 or later. Until you can, Waratek RASP blocks the main way to exploit it with its process and filesystem rules, but a public exploit or tool gets past it. The research note above says which.
Waratek RASP Runtime protection for Java applications
CVSS
8.1 HIGH
v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
CVSS
8.1 HIGH v3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 8.1 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 8.1 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 6.8 | none | AV:N/AC:M/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.tomcat.embed:tomcat-embed-core |
7.0.0 | 7.0.79 |
unbounded |
Products and versions
23 products, 51 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | tomcat | generic | ≥ 7.0.0 and ≤ 7.0.79 |
| nvd | netapp | 7-mode transition tool | generic | any version |
| nvd | netapp | oncommand balance | generic | any version |
| nvd | netapp | oncommand shift | generic | any version |
| osv | org.apache.tomcat.embed | tomcat-embed-core | generic | ≥ 7.0.0 and ＜ 7.0.79 |
| nvd | redhat | enterprise linux desktop | generic | 6.0 · 7.0 |
| nvd | redhat | enterprise linux eus | generic | 7.4 · 7.5 · 7.6 · 7.7 |
| nvd | redhat | enterprise linux eus compute node | generic | 7.4 · 7.5 · 7.6 · 7.7 |
| nvd | redhat | enterprise linux for ibm z systems | generic | 7.0_s390x |
| nvd | redhat | enterprise linux for ibm z systems eus | generic | 7.4_s390x · 7.5_s390x · 7.6_s390x · 7.7_s390x |
| nvd | redhat | enterprise linux for power big endian | generic | 7.0_ppc64 |
| nvd | redhat | enterprise linux for power big endian eus | generic | 7.4_ppc64 · 7.5_ppc64 · 7.6_ppc64 · 7.7_ppc64 |
| nvd | redhat | enterprise linux for power little endian | generic | 7.0_ppc64le |
| nvd | redhat | enterprise linux for power little endian eus | generic | 7.4_ppc64le · 7.5_ppc64le · 7.6_ppc64le · 7.7_ppc64le |
| nvd | redhat | enterprise linux for scientific computing | generic | 7.0 |
| nvd | redhat | enterprise linux server | generic | 6.0 · 7.0 |
| nvd | redhat | enterprise linux server aus | generic | 7.4 · 7.6 · 7.7 |
| nvd | redhat | enterprise linux server for power little endian update services for sap solutions | generic | 7.4_ppc64le · 7.6_ppc64le · 7.7_ppc64le · 9.2_ppc64le |
| nvd | redhat | enterprise linux server tus | generic | 7.4 · 7.6 · 7.7 |
| nvd | redhat | enterprise linux server update services for sap solutions | generic | 7.4 · 7.6 · 7.7 |
| nvd | redhat | enterprise linux workstation | generic | 6.0 · 7.0 |
| nvd | redhat | jboss enterprise web server | generic | 2.0.0 · 3.0.0 |
| nvd | redhat | jboss enterprise web server text-only advisories | generic | any version |
References
Timeline
Timeline
| Published | 2017-09-19 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2019-01-08 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| Added to CISA KEV | 2022-03-25 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| NVD record modified | 2026-08-06 | NVD's own last-modified date for this record. |
| VulnCheck KEV: latest evidence | 2026-11-13 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |