CVE-2017-12615 Apache Tomcat on Windows Remote Code Execution

What is CVE-2017-12615?

CVE-2017-12615 is a high-severity vulnerability in Apache Tomcat, published on 19 Sep 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Weakness: CWE-434

Which versions are affected by CVE-2017-12615?

2 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core. It affects 22 products.

Products include Apache Tomcat, Netapp 7-Mode Transition Tool, Netapp Oncommand Balance, Netapp Oncommand Shift, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus and 16 more.

How do I fix CVE-2017-12615?

Upgrade org.apache.tomcat.embed:tomcat-embed-core to 7.0.79 or later. US federal agencies must fix it by 15 Apr 2022.

Is CVE-2017-12615 being exploited?

Yes. Attackers have exploited CVE-2017-12615 in the wild since at least 25 Mar 2022, including in ransomware campaigns.

Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 19 proofs of concept on GitHub.

Other vulnerabilities in Apache Tomcat

• CVE-2025-24813 Apache Tomcat Path Equivalence Exploited Critical 10.0
• CVE-2016-8735 Apache Tomcat Remote Code Execution Exploited Critical 9.8
• CVE-2017-12617 Apache Tomcat Remote Code Execution Exploited High 8.1
• CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Exploited High 7.5
• CVE-2026-65637 Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete Critical 9.8

All Apache Tomcat vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pjfr-qf3p-3q25.