Skip to content
OpenAdvisories
High · 8.1 Known exploited · Ransomware Scanner template Public exploit CVE-2017-12615 EUVD-2018-0654GHSA-pjfr-qf3p-3q25

When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server

Published Sep 19, 2017 · Updated Aug 6, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Tomcat Package: org.apache.tomcat.embed:tomcat-embed-core Ecosystem: Maven

Description

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Tomcat 7.0.0 to 7.0.79 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 tomcat +9 7.0.76-3.el7_4 RHSA-2017:3081
RHEL 6 tomcat6 +8 6.0.24-111.el6_9 RHSA-2017:3080
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat JBoss Web Server 3 mod_cluster +2 1.3.8-2.Final_redhat_2.1.ep7.el6 RHSA-2018:0466
Red Hat JBoss Web Server 3 tomcat-native 1.2.8-11.redhat_11.ep7.el6 RHSA-2018:0466
Red Hat JBoss Web Server 3 tomcat-vault +2 1.1.6-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0466
Red Hat JBoss Web Server 3 tomcat7 +11 7.0.70-25.ep7.el6 RHSA-2018:0466
Red Hat JBoss Web Server 3 tomcat8 +11 8.0.36-29.ep7.el6 RHSA-2018:0466
Red Hat JBoss Web Server 2 httpd +4 2.2.26-57.ep6.el6 RHSA-2017:3113
Red Hat JBoss Web Server 2 httpd22 +4 2.2.26-58.ep6.el7 RHSA-2017:3113
Red Hat JBoss Web Server 2 jbcs-httpd24-openssl +4 1:1.0.2h-14.jbcs.el6 RHSA-2017:3113
Red Hat JBoss Web Server 2 mod_cluster-native 1.2.13-9.Final_redhat_2.ep6.el6 RHSA-2017:3113
Red Hat JBoss Web Server 2 mod_ssl 1:2.2.26-57.ep6.el6 RHSA-2017:3113
Red Hat JBoss Web Server 2 mod_ssl22 1:2.2.26-58.ep6.el7 RHSA-2017:3113
Red Hat JBoss Web Server 2 tomcat6 +10 6.0.41-19_patch_04.ep6.el6 RHSA-2017:3113
Red Hat JBoss Web Server 2 tomcat7 +10 7.0.54-28_patch_05.ep6.el6 RHSA-2017:3113

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 tomcat 7.0.82-7.16.1 SUSE-SU-2017:3059-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 tomcat +9 7.0.76-3.el7_4 ELSA-2017-3081

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 19 repositories · most starred shown

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tomcat.embed:tomcat-embed-core >= 7.0.0, < 7.0.79 7.0.79 GHSA-pjfr-qf3p-3q25

Advisories 7

References