CVE-2017-12617 Apache Tomcat
| Affected software | Apache Tomcat |
|---|---|
| Severity | 8.1 High CVSS 3.1 3 scores |
| Fixed in | 9.0.1, 8.5.23, 8.0.47, 7.0.82 |
| Weakness | Unrestricted file upload (CWE-434) |
| Published | 4 Oct 2017 |
| Updated | 13 Nov 2026 |
Description
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2022-03-25 · remediation due 2022-04-15 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 4 citations · honeypot sightings · 16 exploits · earliest 2019-04-17.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: total.
- Indexed PoC 12 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2017-10-05.
- EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2017-12617 in VulnCheck (free account), which lists 11 more exploit references not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | VulnCheck canaries | Exploitation attempts seen on 110 days | 2025-10-17 to 2026-11-13 |
| Reported exploitation | blog.talosintelligence.com | /2019/04/seaturtle.html | 2019-04-17 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2022-03-25 |
| Reported exploitation | info.greynoise.io | /hubfs/resources/GreyNoise-How-Resurgent-Vulnerabilities-Jeopardize-Organizational-Security-Report.pdf | 2025-04-23 |
| Reported exploitation | greynoise.io | /blog/coordinated-cloud-based-scanning-operation-targets-75-known-exposure-points | 2025-05-27 |
| Exploit reference | VulnCheck XDB c42eddecf666 | Exploit type: initial-access | 2017-10-05 |
| Exploit reference | VulnCheck XDB bd768a95e919 | Exploit type: initial-access | 2017-10-06 |
| Exploit reference | VulnCheck XDB 4659f86bc8f1 | Exploit type: client-side | 2018-02-09 |
| Exploit reference | VulnCheck XDB a95e521b14fe | Exploit type: initial-access | 2018-12-19 |
| Exploit reference | VulnCheck XDB c733f0b8ba46 | Exploit type: initial-access | 2020-09-23 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution | 400 | 2017-10-05 |
| Nuclei | Apache Tomcat - Remote Code Execution | ||
| Exploit-DB | Tomcat - Remote Code Execution via JSP Upload Bypass (Metasploit) | 2017-10-17 | |
| Metasploit | Tomcat RCE via JSP Upload Bypass (excellent rank) | ||
| GitHub PoC | CVE-2017-12617 is a critical vulnerability leading to Remote Code Execution (RCE) in Apache Tomcat. | 6 | 2021-12-10 |
| Exploit-DB | Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (2) | 2017-10-09 | |
| GitHub PoC | Proof of Concept - RCE Exploitation : Web Shell on Apache Tomcat - Ensimag January 2018 | 2 | 2019-01-14 |
| GitHub PoC | An implementation of CVE-2017-12617 | 1 | 2021-07-27 |
| GitHub PoC | Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution for Python3 | 1 | 2021-02-04 |
| GitHub PoC | Improved version of PikaChu CVE | 2024-12-13 |
Waratek protection
Waratek has a rule that blocks the main way to exploit this vulnerability, but a public exploit or tool gets past it.
- Protection partial Process, Filesystem
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE partially protected by the ARMR Process rule, ARMR Filesystem Write: a public exploit or tool reaches the rated impact without tripping it. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: ARMR Process rule, ARMR Filesystem Write
Tomcat PUT .jsp/ upload bypass → JSP webshell (CWE-434); blocks webshell commands that start a program. (partial coverage: the upload itself, and a webshell that reads or copies out data directly in Java, are not stopped).
Same vulnerability class as CVE-2017-12615 (12615 is the original PUT upload flaw; 12617 is the bypass of its fix).
The Configuration Aspect: Tomcat’s default setting keeps the readonly initialization parameter set to true on its DefaultServlet, which blocks arbitrary file uploads. For CVE-2017-12617 to be exposed, an administrator must explicitly change readonly to false in web.xml (or manually enable HTTP PUT requests).
For some Application it is possible to define a filesystem write rule with input(http) on webapp *.jsp paths which will block the upload itself.
How to mitigate CVE-2017-12617
Upgrade Apache Tomcat to a release that fixes it: 9.0.1, 8.5.23, 8.0.47 or 7.0.82. Until you can, Waratek RASP blocks the main way to exploit it with its process and filesystem rules, but a public exploit or tool gets past it. The research note above says which.
Waratek RASP Runtime protection for Java applications
CVSS
8.1 HIGH
v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
CVSS
8.1 HIGH v3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 8.1 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 8.1 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 6.8 | none | AV:N/AC:M/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update July 2018 ↗ | CPU | 2018-Q3 | Oracle Fusion Middleware / Common Components (Apache Tomcat) (12.2.1.2.0, 12.2.1.3.0) Oracle Retail Applications / OPT Server (Apache Tomcat) (2.1.132) |
| Oracle Critical Patch Update April 2018 ↗ | CPU | 2018-Q2 | Oracle Construction and Engineering Suite / Web Server (Apache Tomcat) (17.1, 17.2) Oracle Financial Services Applications / Infrastructure (Apache Tomcat) (7.3.x, 8.0.x) Oracle's note: Please refer MOS document ( Doc ID 2380553.1) for applicability across other Oracle Financial Services products. Oracle Fusion Middleware / Advanced UI (Apache Tomcat) (11.1.1.8.0) Oracle Fusion Middleware / Monitor (Apache Tomcat) (11.2.1.0.13) Oracle Retail Applications / Upgrade Install (Apache Tomcat) (5.2, 15.0) |
| Oracle Critical Patch Update January 2018 ↗ | CPU | 2018-Q1 | Oracle Database Server / WLM (Apache Tomcat) (12.2.0.1) Oracle Fusion Middleware / Other Issues (Apache Tomcat) (3.1.0, 3.2.0) Oracle Fusion Middleware / tsam-General (Apache Tomcat) (12.1.3.0.0) Oracle Health Sciences Applications / Base (Apache Tomcat) (1.0.1.1) Oracle Hospitality Applications / Base (Apache Tomcat) (4.2.0, 4.2.1) Oracle MySQL / Monitoring: General (Apache Tomcat) (3.3.6.3293 and prior, 3.4.4.4226 and prior, 4.0.0.5135 and prior) Oracle Retail Applications / Retail (Apache Tomcat) (10.0.1, 10.5.0, 10.6.0, 10.7.0, 10.8.0, 10.8.1) Oracle Supply Chain Products Suite / Folders, Files & Attachments (Apache Tomcat) (9.3.3, 9.3.4, 9.3.5, 9.3.6) Oracle Supply Chain Products Suite / Install (Apache Tomcat) (6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Construction and Engineering Suite | Web Server (Apache Tomcat) | 17.1, 17.2 | 17.1 · 17.2 |
| Oracle Database Server | WLM (Apache Tomcat) | 12.2.0.1 | 12.2.0.1 |
| Oracle Financial Services Applications | Infrastructure (Apache Tomcat) | 7.3.x, 8.0.x | 7.3 · 8.0 |
| Oracle Fusion Middleware | Advanced UI (Apache Tomcat) | 11.1.1.8.0 | 11.1.1.8.0 |
| Oracle Fusion Middleware | Common Components (Apache Tomcat) | 12.2.1.2.0, 12.2.1.3.0 | 12.2.1.2.0 · 12.2.1.3.0 |
| Oracle Fusion Middleware | Monitor (Apache Tomcat) | 11.2.1.0.13 | 11.2.1.0.13 |
| Oracle Fusion Middleware | Other Issues (Apache Tomcat) | 3.1.0, 3.2.0 | 3.1.0 · 3.2.0 |
| Oracle Fusion Middleware | tsam-General (Apache Tomcat) | 12.1.3.0.0 | 12.1.3.0.0 |
| Oracle Health Sciences Applications | Base (Apache Tomcat) | 1.0.1.1 | 1.0.1.1 |
| Oracle Hospitality Applications | Base (Apache Tomcat) | 4.2.0, 4.2.1 | 4.2.0 · 4.2.1 |
| Oracle MySQL | Monitoring: General (Apache Tomcat) | 3.3.6.3293 and prior, 3.4.4.4226 and prior, 4.0.0.5135 and prior | |
| Oracle Retail Applications | OPT Server (Apache Tomcat) | 2.1.132 | 2.1.132 |
| Oracle Retail Applications | Retail (Apache Tomcat) | 10.0.1, 10.5.0, 10.6.0, 10.7.0, 10.8.0, 10.8.1 | 10.0.1 · 10.5.0 · 10.6.0 · 10.7.0 · 10.8.0 · 10.8.1 |
| Oracle Retail Applications | Upgrade Install (Apache Tomcat) | 5.2, 15.0 | 5.2 · 15.0 |
| Oracle Supply Chain Products Suite | Folders, Files & Attachments (Apache Tomcat) | 9.3.3, 9.3.4, 9.3.5, 9.3.6 | 9.3.3 · 9.3.4 · 9.3.5 · 9.3.6 |
| Oracle Supply Chain Products Suite | Install (Apache Tomcat) | 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7 | 6.3.1 · 6.3.2 · 6.3.3 · 6.3.4 · 6.3.5 · 6.3.6 · 6.3.7 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.tomcat:tomcat-catalina |
9.0.0.M1 | 9.0.1 |
unbounded |
org.apache.tomcat:tomcat-catalina |
8.5.0 | 8.5.23 |
unbounded |
org.apache.tomcat:tomcat-catalina |
8.0.0-RC1 | 8.0.47 |
unbounded |
org.apache.tomcat:tomcat-catalina |
7.0.0 | 7.0.82 |
unbounded |
org.apache.tomcat.embed:tomcat-embed-core |
9.0.0.M1 | 9.0.1 |
unbounded |
org.apache.tomcat.embed:tomcat-embed-core |
8.5.0 | 8.5.23 |
unbounded |
org.apache.tomcat.embed:tomcat-embed-core |
8.0.0-RC1 | 8.0.47 |
unbounded |
org.apache.tomcat.embed:tomcat-embed-core |
7.0.0 | 7.0.82 |
unbounded |
Products and versions
60 products, 165 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | tomcat | generic | ≥ 7.0.0 and ＜ 7.0.82 · ≥ 8.0 and ＜ 8.0.47 · ≥ 8.5.0 and ＜ 8.5.23 · ≥ 9.0.0 and ＜ 9.0.1 |
| nvd | canonical | ubuntu linux | generic | 12.04 · 16.04 · 17.10 · 18.04 |
| nvd | debian | debian linux | generic | 7.0 |
| nvd | netapp | active iq unified manager | generic | ≥ 7.3 · ≥ 9.5 |
| nvd | netapp | element | generic | any version |
| nvd | netapp | oncommand balance | generic | any version |
| nvd | netapp | oncommand insight | generic | any version |
| nvd | netapp | oncommand shift | generic | any version |
| nvd | netapp | oncommand workflow automation | generic | any version |
| nvd | netapp | snapcenter | generic | any version |
| nvd | oracle | agile product lifecycle management | generic | 9.3.3 · 9.3.4 · 9.3.5 · 9.3.6 |
| nvd | oracle | communications instant messaging server | generic | 10.0.1 |
| nvd | oracle | endeca information discovery integrator | generic | 3.1.0 · 3.2.0 |
| nvd | oracle | enterprise manager for mysql database | generic | 12.1.0.4.0 |
| nvd | oracle | financial services analytical applications infrastructure | generic | ≥ 7.3.3.0.0 and ≤ 7.3.5.3.0 · ≥ 8.0.0.0.0 and ≤ 8.0.9.0.0 |
| nvd | oracle | fmw platform | generic | 12.2.1.2.0 · 12.2.1.3.0 |
| nvd | oracle | health sciences empirica inspections | generic | 1.0.1.1 |
| nvd | oracle | hospitality guest access | generic | 4.2.0 · 4.2.1 |
| nvd | oracle | instantis enterprisetrack | generic | 17.1 · 17.2 |
| nvd | oracle | management pack | generic | 11.2.1.0.13 |
| nvd | oracle | micros lucas | generic | 2.9.5 |
| nvd | oracle | micros retail xbri loss prevention | generic | 10.0.1 · 10.5.0 · 10.6.0 · 10.7.0 · 10.8.0 · 10.8.1 |
| nvd | oracle | mysql enterprise monitor | generic | ≤ 3.3.6.3293 · ≥ 3.4.0 and ≤ 3.4.4.4226 · ≥ 4.0.0 and ≤ 4.0.0.5135 |
| nvd | oracle | retail advanced inventory planning | generic | 13.2 · 13.4 · 14.1 · 15.0 |
| nvd | oracle | retail back office | generic | 14.0.4 · 14.1.3 |
| nvd | oracle | retail central office | generic | 14.0.4 · 14.1.3 |
| nvd | oracle | retail convenience and fuel pos software | generic | 2.1.132 |
| nvd | oracle | retail eftlink | generic | 1.1.124 · 15.0.1 · 16.0.2 |
| nvd | oracle | retail insights | generic | 14.0 · 14.1 · 15.0 · 16.0 |
| nvd | oracle | retail invoice matching | generic | 12.0 · 13.0 · 13.1 · 13.2 · 14.0 · 14.1 · 15.0 · 16.0 |
| nvd | oracle | retail order broker | generic | 5.0 · 5.1 · 5.2 · 15.0 · 16.0 |
| nvd | oracle | retail order management system | generic | 4.0 · 4.5 · 4.7 · 5.0 |
| nvd | oracle | retail point-of-service | generic | 14.0.4 · 14.1.3 |
| nvd | oracle | retail price management | generic | 12.0 · 13.0 · 13.1 · 13.2 · 14.0 · 14.1 · 15.0 · 16.0 |
| nvd | oracle | retail returns management | generic | 2.3.8 · 2.4.9 · 14.0.4 · 14.1.3 |
| nvd | oracle | retail store inventory management | generic | 12.0.12 · 13.0.7 · 13.1.9 · 13.2.9 · 14.0.4 · 14.1.3 · 15.0.2 · 16.0.1 |
| nvd | oracle | retail xstore point of service | generic | 6.0.11 · 7.0.6 · 7.1.6 · 15.0.1 |
| nvd | oracle | transportation management | generic | 6.3.1 · 6.3.2 · 6.3.3 · 6.3.4 · 6.3.5 · 6.3.6 · 6.3.7 |
| nvd | oracle | tuxedo system and applications monitor | generic | 12.1.3.0.0 |
| nvd | oracle | webcenter sites | generic | 11.1.1.8.0 |
| nvd | oracle | workload manager | generic | 12.2.0.1 |
| osv | org.apache.tomcat | tomcat-catalina | generic | ≥ 7.0.0 and ＜ 7.0.82 · ≥ 8.0.0 and ＜ 8.0.47 · ≥ 8.5.0 and ＜ 8.5.23 · ≥ 9.0.0 and ＜ 9.0.1 |
| osv | org.apache.tomcat.embed | tomcat-embed-core | generic | ≥ 7.0.0 and ＜ 7.0.82 · ≥ 8.0.0 and ＜ 8.0.47 · ≥ 8.5.0 and ＜ 8.5.23 · ≥ 9.0.0 and ＜ 9.0.1 |
| nvd | redhat | enterprise linux desktop | generic | 6.0 · 7.0 |
| nvd | redhat | enterprise linux eus | generic | 7.4 · 7.5 · 7.6 · 7.7 |
| nvd | redhat | enterprise linux eus compute node | generic | 7.4 · 7.5 · 7.6 · 7.7 |
| nvd | redhat | enterprise linux for ibm z systems | generic | 6.0_s390x · 7.0_s390x |
| nvd | redhat | enterprise linux for ibm z systems eus | generic | 7.4_s390x · 7.5_s390x · 7.6_s390x · 7.7_s390x |
| nvd | redhat | enterprise linux for power big endian | generic | 6.0_ppc64 · 7.0_ppc64 |
| nvd | redhat | enterprise linux for power big endian eus | generic | 7.4_ppc64 · 7.5_ppc64 · 7.6_ppc64 · 7.7_ppc64 |
| nvd | redhat | enterprise linux for power little endian | generic | 7.0 |
| nvd | redhat | enterprise linux for power little endian eus | generic | 7.4_ppc64le · 7.5_ppc64le · 7.6_ppc64le · 7.7_ppc64le |
| nvd | redhat | enterprise linux server | generic | 6.0 · 7.0 |
| nvd | redhat | enterprise linux server aus | generic | 7.4 · 7.6 · 7.7 |
| nvd | redhat | enterprise linux server tus | generic | 7.4 · 7.6 · 7.7 |
| nvd | redhat | enterprise linux workstation | generic | 6.0 · 7.0 |
| nvd | redhat | fuse | generic | 1.0 |
| nvd | redhat | jboss enterprise application platform | generic | 6.0.0 · 6.4.0 |
| nvd | redhat | jboss enterprise web server | generic | 2.0.0 · 3.0.0 |
| nvd | redhat | jboss enterprise web server text-only advisories | generic | any version |
References
Timeline
Timeline
| Published | 2017-10-04 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2019-04-17 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| Added to CISA KEV | 2022-03-25 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| NVD record modified | 2026-08-25 | NVD's own last-modified date for this record. |
| VulnCheck KEV: latest evidence | 2026-11-13 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |