Apache Tomcat: Schwachstelle ermöglicht Codeausführung

Summary

Product

Vulnerabilities 1

• High 8.1
  CVE-2017-12617 Exploited Public exploit Scanner template EPSS 100%

  Unrestricted Upload of File with Dangerous Type Apache Tomcat

  When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP fil…

  Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  Oct 3, 2017

  KEV Mar 25, 2022

Revision history

1. 2025-02-20 #20

   Neue Updates von Ubuntu aufgenommen

2. 2021-04-21 #19

   Neue Updates von SUSE aufgenommen

3. 2021-03-31 #18

   Neue Updates von HPE aufgenommen

4. 2019-08-22 #17

   Neue Updates von Symantec aufgenommen

5. 2018-10-17 #16

   New remediations available

6. 2018-03-07 #15

   New remediations available

7. 2018-02-18 #14

   New remediations available

8. 2018-02-05 #13

   New remediations available

9. 2017-12-13 #12

   New remediations available

10. 2017-12-07 #11

    New remediations available

11. 2017-11-23 #10

    New remediations available

12. 2017-11-22 #9

    New remediations available

13. 2017-11-02 #8

    New remediations available

14. 2017-10-31 #7

    New remediations available

15. 2017-10-25 #6

    Added references

16. 2017-10-24 #4

    New remediations available

17. 2017-10-24 #5

    Version nicht vorhanden

18. 2017-10-15 #2

    Exploit published

19. 2017-10-15 #3

    Version nicht vorhanden

20. 2017-10-03 #1

    Initial Release

References

• Apache Tomcat Release Notes vom 2017-10-03
  http://tomcat.apache.org/security-9.html
• Apache Tomcat Release Notes vom 2017-10-03
  http://tomcat.apache.org/security-8.html
• Apache Tomcat Release Notes vom 2017-10-03
  http://tomcat.apache.org/security-7.html
• National Vulnerability Database Eintrag vom 2017-10-03
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12617
• Metasploit Module vom 2017-10-11
  https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_jsp_upload_bypass.rb
• Oracle Linux Security Advisory ELSA-2017-3081 vom 2017-10-30
  http://linux.oracle.com/errata/ELSA-2017-3081.html
• Oracle Linux Security Advisory ELSA-2017-3080 vom 2017-10-30
  http://linux.oracle.com/errata/ELSA-2017-3080.html
• Red Hat Security Advisory RHSA-2017:3081 vom 2017-10-30
  https://access.redhat.com/errata/RHSA-2017:3081
• Red Hat Security Advisory RHSA-2017:3080 vom 2017-10-30
  https://access.redhat.com/errata/RHSA-2017:3080
• CentOS Security Advisory CESA-2017:3081 vom 2017-10-30
  https://lwn.net/Alerts/737719
• CentOS Security Advisory CESA-2017:3080 vom 2017-10-30
  https://lwn.net/Alerts/737720
• Red Hat Security Advisory RHSA-2017:3114 vom 2017-11-02
  https://access.redhat.com/errata/RHSA-2017:3114
• Red Hat Security Advisory RHSA-2017:3113 vom 2017-11-02
  https://access.redhat.com/errata/RHSA-2017:3113
• SUSE Security Update SUSE-SU-2017:3039-1 vom 2017-11-23
  https://www.suse.com/support/update/announcement/2017/suse-su-20173039-1.html
• SUSE Security Update SUSE-SU-2017:3059-1 vom 2017-11-24
  https://www.suse.com/support/update/announcement/2017/suse-su-20173059-1.html
• McAfee Security Bulletin SB10218
  https://kc.mcafee.com/corporate/index?page=content&id=SB10218
• SUSE Security Update SUSE-SU-2017:3279-1 vom 2017-12-14
  https://www.suse.com/support/update/announcement/2017/suse-su-20173279-1.html
• Red Hat Security Advisory RHSA-2018:0275 vom 2018-02-05
  https://access.redhat.com/errata/RHSA-2018:0275
• Red Hat Security Advisory RHSA-2018:0271 vom 2018-02-05
  https://access.redhat.com/errata/RHSA-2018:0271
• Red Hat Security Advisory RHSA-2018:0270 vom 2018-02-05
  https://access.redhat.com/errata/RHSA-2018:0270
• Red Hat Security Advisory RHSA-2018:0269 vom 2018-02-05
  https://access.redhat.com/errata/RHSA-2018:0269
• NetApp Security Advisory NTAP-20171018-0002 vom 2018-02-16
  https://security.netapp.com/advisory/ntap-20171018-0002/
• Red Hat Security Advisory RHSA-2018:0466 vom 2018-03-07
  https://access.redhat.com/errata/RHSA-2018:0466
• Red Hat Security Advisory RHSA-2018:0465 vom 2018-03-07
  https://access.redhat.com/errata/RHSA-2018:0465
• Red Hat Security Advisory RHSA-2018:2939 vom 2018-10-17
  https://access.redhat.com/errata/RHSA-2018:2939
• Symantec Securtity Advisory SYMSA1419
  https://support.symantec.com/us/en/article.SYMSA1419.html
• HPE Security Bulletin HPESBUX04114 vom 2021-03-31
  https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbux04114en_us
• SUSE Security Update SUSE-SU-2021:14705-1 vom 2021-04-21
  https://lists.suse.com/pipermail/sle-security-updates/2021-April/008669.html
• Ubuntu Security Notice USN-7282-1 vom 2025-02-21
  https://ubuntu.com/security/notices/USN-7282-1