{"id":"CVE-2017-12615","published":"2017-09-19T13:29:00Z","modified":"2026-08-06T05:16:34Z","title":"Apache Tomcat on Windows Remote Code Execution Vulnerability","vendor":"Apache","product":"Tomcat","tier":"core","eol":null,"description":{"text":"When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an unrestricted file upload weakness in Apache Tomcat's default servlet on Windows, affecting Tomcat 7.0.0 through 7.0.79. Where HTTP PUT is enabled (for example by setting the default servlet's readonly initialisation parameter to false), an attacker who sends a specially crafted request can upload a JSP file that the server will then execute as code when requested, requiring no authentication or user interaction and only network access to the server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:58:44Z"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99707,"percentile":0.99952,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-12615","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-01-08","exploitedFirstSeen":"2019-01-08","ransomware":true,"evidence":[{"url":"https://www.lacework.com/blog/elf-of-the-month-new-lucky-ransomware-sample/","date":"2019-01-08"},{"url":"https://www.alibabacloud.com/blog/threat-alert-multiple-cryptocurrency-miner-botnets-start-to-exploit-the-new-thinkphp-vulnerability_594369","date":"2019-01-13"},{"url":"https://www.fortinet.com/blog/threat-research/closer-look-satan-ransomwares-propagation-technics","date":"2019-05-20"},{"url":"https://www.trendmicro.com/en_us/research/19/f/blacksquid-slithers-into-servers-and-drives-with-8-notorious-exploits-to-drop-xmrig-miner.html","date":"2019-06-03"},{"url":"https://s.tencent.com/research/report/737.html","date":"2019-06-11"},{"url":"https://web.archive.org/web/20220227045141/https://risksense.com/wp-content/uploads/2019/09/RiskSense-Spotlight-Report-Ransomware.pdf","date":"2019-09-01"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-25&host_type=src&vulnerability=cve-2017-12615","date":"2023-12-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-28&host_type=src&vulnerability=cve-2017-12615","date":"2023-12-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-30&host_type=src&vulnerability=cve-2017-12615","date":"2023-12-30"}],"evidenceTotal":188,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"TSEC Honeypot: Exploit Attempt - Week of 2026-10-19","url":"https://otx.alienvault.com/pulse/6adbabda1387f621bb68b955","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"}],"references":[{"url":"http://breaktoprotect.blogspot.com/2017/09/the-case-of-cve-2017-12615-tomcat-7-put.html","tags":["Exploit"]},{"url":"http://www.securityfocus.com/bid/100901","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039392","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3080","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3081","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3113","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3114","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0465","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0466","tags":["Third Party Advisory"]},{"url":"https://github.com/breaktoprotect/CVE-2017-12615","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/8fcb1e2d5895413abcf266f011b9918ae03e0b7daceb118ffbf23f8c%40%3Cannounce.tomcat.apache.org%3E","tags":["Issue Tracking","Mailing List"]},{"url":"https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://security.netapp.com/advisory/ntap-20171018-0001/","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/42953/","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.synology.com/support/security/Synology_SA_17_54_Tomcat","tags":["Third Party Advisory"]},{"url":"http://breaktoprotect.blogspot.com/2017/09/the-case-of-cve-2017-12615-tomcat-7-put.html","tags":["Exploit"]},{"url":"http://www.securityfocus.com/bid/100901","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039392","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3080","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3081","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3113","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3114","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0465","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0466","tags":["Third Party Advisory"]},{"url":"https://github.com/breaktoprotect/CVE-2017-12615","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/8fcb1e2d5895413abcf266f011b9918ae03e0b7daceb118ffbf23f8c%40%3Cannounce.tomcat.apache.org%3E","tags":["Issue Tracking","Mailing List"]},{"url":"https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","tags":["Mailing List"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://security.netapp.com/advisory/ntap-20171018-0001/","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/42953/","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.synology.com/support/security/Synology_SA_17_54_Tomcat","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12615","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Crafted HTTP PUT request exploits public-facing web app","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"it was possible to upload a JSP file to the server via a specially crafted request","start":158,"end":240}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Uploaded JSP webshell enables server-side code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"This JSP could then be requested and any code it contained would be executed by the server","start":242,"end":332}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=7.0.0, <7.0.79"],"patched":["7.0.79"],"from":["GHSA-pjfr-qf3p-3q25"],"provenance":"source"}],"advisories":[{"id":"GHSA-pjfr-qf3p-3q25","url":"https://github.com/advisories/GHSA-pjfr-qf3p-3q25","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=7.0.0, <7.0.79"],"patched":["7.0.79"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2018-0654","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0654","exploited":true,"exploitedSince":"2022-03-25","provenance":"source"},"exploits":[{"id":42953,"url":"https://www.exploit-db.com/exploits/42953","title":"Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1)","type":"webapps","platform":"windows","date":"2017-09-20","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2017-09-20"},"pocGithub":{"count":17,"skipped":2,"earliest":"2017-09-23","earliestUrl":"https://github.com/breaktoprotect/CVE-2017-12615","repos":[{"name":"lizhianyuguangming/TomcatScanPro","url":"https://github.com/lizhianyuguangming/TomcatScanPro","stars":297,"created":"2024-08-29"},{"name":"tpt11fb/AttackTomcat","url":"https://github.com/tpt11fb/AttackTomcat","stars":258,"created":"2022-11-13"},{"name":"breaktoprotect/CVE-2017-12615","url":"https://github.com/breaktoprotect/CVE-2017-12615","stars":112,"created":"2017-09-23"},{"name":"xiaokp7/Tomcat_PUT_GUI_EXP","url":"https://github.com/xiaokp7/Tomcat_PUT_GUI_EXP","stars":11,"created":"2023-03-10"},{"name":"mefulton/cve-2017-12615","url":"https://github.com/mefulton/cve-2017-12615","stars":10,"created":"2017-09-25"}]},"nuclei":[{"id":"CVE-2017-12615","name":"Apache Tomcat Servers - Remote Code Execution","severity":"high","path":"http/cves/2017/CVE-2017-12615.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12615.yaml"}],"first":{"date":"2017-09-20","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/42953"},"provenance":"source"},"exploitRefs":["http://breaktoprotect.blogspot.com/2017/09/the-case-of-cve-2017-12615-tomcat-7-put.html","https://github.com/breaktoprotect/CVE-2017-12615","https://www.exploit-db.com/exploits/42953/","https://www.exploit-db.com/exploits/42953"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1505.003"],"provenance":"ai"}],"timeline":[{"date":"2017-09-19","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12615","provenance":"source"},{"date":"2017-09-20","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-42953); later: PoC-in-GitHub 2017-09-23","url":"https://www.exploit-db.com/exploits/42953","provenance":"source"},{"date":"2019-01-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.lacework.com/blog/elf-of-the-month-new-lucky-ransomware-sample/","provenance":"source"},{"date":"2022-03-25","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0654","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"Exploit-DB","daysToKev":1648},"priority":{"score":78.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2853 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9995"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Exploit-DB entry; 1 NVD exploit link; 1 advisory exploit reference; 17 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-tomcat-cve-2017-12615","packageHistory":[{"cve":"CVE-2008-1947","published":"2008-06-04","fixed":"6.0.18","kev":false},{"cve":"CVE-2017-12615","published":"2017-09-19","fixed":"7.0.79","kev":true},{"cve":"CVE-2014-0095","published":"2014-05-31","fixed":"8.0.4","kev":false},{"cve":"CVE-2017-5648","published":"2017-04-17","fixed":"9.0.0.M18","kev":false,"link":{"from":"CVE-2017-5648","to":"CVE-2017-12615","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"7.0.76","toFixed":"7.0.79","daysApart":155}]}},{"cve":"CVE-2017-5651","published":"2017-04-17","fixed":"9.0.0.M19","kev":false},{"cve":"CVE-2017-12617","published":"2017-10-04","fixed":"9.0.1","kev":true,"link":{"from":"CVE-2017-12615","to":"CVE-2017-12617","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"7.0.79","toFixed":"7.0.82","daysApart":15},{"kind":"similar","provenance":"machine","score":0.93,"basis":"same product + CWE + description similarity"}]}}],"package":"Maven:org.apache.tomcat.embed:tomcat-embed-core"}}