CVE-2017-12617

Confirmed PUBLISHED

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via...

Apache Software Foundation · Apache Tomcat

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

8.1 High

At a Glance

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

cisa metasploit nuclei_scanner apache

CVE Published: Oct 03, 2017
Exploitation Reported: Mar 25, 2022
CVSS: 8.1 High
EPSS: —

Remote No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Apache Software Foundation	Apache Tomcat	9.0.0.M1 to 9.0.0	Affected
Apache Software Foundation	Apache Tomcat	8.5.0 to 8.5.22	Affected
Apache Software Foundation	Apache Tomcat	8.0.0.RC1 to 8.0.46	Affected
Apache Software Foundation	Apache Tomcat	7.0.0 to 7.0.81	Affected

CVE References

RHSA-2017:3113 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2017:3113
RHSA-2017:3080 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2017:3080
RHSA-2018:0269 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0269
RHSA-2018:0270 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0270
RHSA-2018:0271 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0271

Show 39 more references

RHSA-2018:2939 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2018:2939
RHSA-2018:0465 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0465
USN-3665-1 usn.ubuntu.com · Vendor Advisory https://usn.ubuntu.com/3665-1/
RHSA-2018:0268 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0268
RHSA-2017:3114 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2017:3114
RHSA-2018:0275 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0275
RHSA-2018:0466 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0466
RHSA-2017:3081 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2017:3081
42966 exploit-db.com · Exploit https://www.exploit-db.com/exploits/42966/
43008 exploit-db.com · Exploit https://www.exploit-db.com/exploits/43008/
1039552 securitytracker.com · VDB Entry http://www.securitytracker.com/id/1039552
100954 securityfocus.com · VDB Entry http://www.securityfocus.com/bid/100954
[debian-lts-announce] 20171107 [SECURITY] [DLA 1166-1] tomcat7 security update lists.debian.org · Mailing List https://lists.debian.org/debian-lts-announce/2017/11/msg00009.html
[announce] 20171003 [SECURITY] CVE-2017-12617 Apache Tomcat Remote Code Execution via JSP upload lists.apache.org · Mailing List https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c...
[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d...
[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11...
[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73f...
[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a...
[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63...
[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570c...
[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d...
[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2...
[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad22...
[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160...
[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284f...
[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd0...
[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736...
[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2...
[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b...
[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc29...
oracle.com/technetwork/security-advisory/cpujul2018-425... oracle.com · CVE Record http://www.oracle.com/technetwork/security-advisory/cpujul2018-425824...
oracle.com/technetwork/security-advisory/cpujan2018-323... oracle.com · CVE Record http://www.oracle.com/technetwork/security-advisory/cpujan2018-323662...
support.hpe.com/hpsc/doc/public/display support.hpe.com · CVE Record https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId...
support.hpe.com/hpsc/doc/public/display support.hpe.com · CVE Record https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId...
oracle.com/technetwork/security-advisory/cpuapr2018-367... oracle.com · CVE Record http://www.oracle.com/technetwork/security-advisory/cpuapr2018-367806...
security.netapp.com/advisory/ntap-20171018-0002 security.netapp.com · CVE Record https://security.netapp.com/advisory/ntap-20171018-0002/
security.netapp.com/advisory/ntap-20180117-0002 security.netapp.com · CVE Record https://security.netapp.com/advisory/ntap-20180117-0002/
support.f5.com/csp/article/K53173544 support.f5.com · CVE Record https://support.f5.com/csp/article/K53173544
oracle.com/technetwork/security-advisory/cpuapr2019-507... oracle.com · CVE Record https://www.oracle.com/technetwork/security-advisory/cpuapr2019-50728...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2022-03-25 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12617.yaml	Apr 25, 2025
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_jsp_upload_bypass.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 8.1 High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 6.8 Medium

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitation Status

Exploited in the wild

Recorded 2022-03-25 00:00:00 UTC · CISA

Proof of concept available

Recorded 2017-10-05 23:41:52 UTC · GitHub

Weaknesses (CWE)

CWE-434

Unrestricted Upload of File with Dangerous Type

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_jsp_upload_bypass.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12617.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

DevaDJ/CVE-2017-12617

github · Created 2024-12-13 11:22:38 UTC · 0 stars

Improved version of PikaChu CVE

yZeetje/CVE-2017-12617

github · Created 2024-07-04 07:23:39 UTC · 0 stars

CVE-2017-12617

scirusvulgaris/CVE-2017-12617

github · Created 2024-06-28 08:33:41 UTC · 0 stars

K3ysTr0K3R/CVE-2017-12617-EXPLOIT

github · Created 2024-03-18 20:10:46 UTC · 0 stars

LongWayHomie/CVE-2017-12617

github · Created 2021-12-10 22:21:07 UTC · 3 stars

CVE-2017-12617 is a critical vulnerability leading to Remote Code Execution (RCE) in Apache Tomcat.

ygouzerh/CVE-2017-12617

github · Created 2019-01-14 20:58:29 UTC · 2 stars

Proof of Concept - RCE Exploitation : Web Shell on Apache Tomcat - Ensimag January 2018

qiantu88/CVE-2017-12617

github · Created 2018-12-19 10:26:33 UTC · 0 stars

devcoinfet/CVE-2017-12617

github · Created 2018-02-09 01:02:32 UTC · 0 stars

Code put together from a few peoples ideas credit given don't use maliciously please

cyberheartmi9/CVE-2017-12617

github · Created 2017-10-05 23:41:52 UTC · 390 stars

Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution

Apache Tomcat - Remote Code Execution

nuclei · Created Unknown

tomcat_jsp_upload_bypass

metasploit · Created Unknown

Metasploit module for CVE-2017-12617

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2017-12617

{
  "cve_id": "CVE-2017-12617",
  "title": "When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0...",
  "affected_vendor": "Apache Software Foundation",
  "affected_product": "Apache Tomcat",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 8.1,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2017-12617

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API