CVE-2017-12617 Apache Tomcat Remote Code Execution
Attackers can upload and execute malicious JSP files on Apache Tomcat servers if HTTP PUT is enabled, leading to remote code execution.
- Exploited in the wild
- Since 25 Mar 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-12617?
CVE-2017-12617 is a high-severity vulnerability in Apache Tomcat, published on 3 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Weakness: CWE-434
Which versions are affected by CVE-2017-12617?
16 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core and org.apache.tomcat:tomcat-catalina. It affects 58 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-core Maven | From 7.0.0 | 7.0.82 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 7.0.0 | 7.0.82 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.0.0-RC1 | 8.0.47 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.0.0-RC1 | 8.0.47 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.0 | 8.5.23 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.0 | 8.5.23 |
10 more packages
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0.M1 | 9.0.1 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0.M1 | 9.0.1 |
org.apache.tomcat:tomcat-catalina Maven | From 7.0.0 | 7.0.82 |
org.apache.tomcat:tomcat-catalina Maven | From 7.0.0 | 7.0.82 |
org.apache.tomcat:tomcat-catalina Maven | From 8.0.0-RC1 | 8.0.47 |
org.apache.tomcat:tomcat-catalina Maven | From 8.0.0-RC1 | 8.0.47 |
org.apache.tomcat:tomcat-catalina Maven | From 8.5.0 | 8.5.23 |
org.apache.tomcat:tomcat-catalina Maven | From 8.5.0 | 8.5.23 |
org.apache.tomcat:tomcat-catalina Maven | From 9.0.0.M1 | 9.0.1 |
org.apache.tomcat:tomcat-catalina Maven | From 9.0.0.M1 | 9.0.1 |
Products include Apache Tomcat, Canonical Ubuntu Linux, Debian Debian Linux, Netapp Active Iq Unified Manager, Netapp Element, Netapp Oncommand Balance and 52 more.
How do I fix CVE-2017-12617?
Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 7.0.82, 8.0.47, 8.5.23 or 9.0.1. US federal agencies must fix it by 15 Apr 2022.
Is CVE-2017-12617 being exploited?
Yes. Attackers have exploited CVE-2017-12617 in the wild since at least 25 Mar 2022.
Public exploit code: 1 Metasploit module, 2 Exploit-DB entries, 1 Nuclei template and 10 proofs of concept on GitHub.
Other vulnerabilities in Apache Tomcat
- CVE-2025-24813 Apache Tomcat Path Equivalence
- CVE-2016-8735 Apache Tomcat Remote Code Execution
- CVE-2017-12615 Apache Tomcat on Windows Remote Code Execution
- CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data
- CVE-2026-65637 Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete
Sources
Also known as DLA-1166-1, GHSA-xjgh-84hx-56c5, MGASA-2017-0400, UBUNTU-CVE-2017-12617.