Skip to content
OpenAdvisories
High 1 exploited CVE USN-7282-1 2 CVEs

tomcat7 vulnerabilities

Published Feb 21, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Tomcat incorrectly handled being configured with
HTTP PUTs enabled. A remote attacker could use this issue to upload a JSP
file to the server and execute arbitrary code.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS tomcat7 7.0.68-1ubuntu0.4+esm3

Vulnerabilities 2

  • High 8.1
    CVE-2017-12617 Exploited Public exploit Scanner template EPSS 100%

    Unrestricted Upload of File with Dangerous Type Apache Tomcat

    When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP fil…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
    KEV Mar 25, 2022
  • High 7.5
    CVE-2017-12616 EPSS 70%

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

    When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

    Apache Software Foundation Apache Tomcat tomcat7 org.apache.tomcat:tomcat-catalina Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2017-12616
  • report
    https://ubuntu.com/security/CVE-2017-12617