Advisory details:
github_osv / GHSA-pjfr-qf3p-3q25
| Advisory ID | github_osv/GHSA-pjfr-qf3p-3q25 |
| Aliases |
CVE-2017-12615
|
| Summary | When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 7.3 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3 | 8.1 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-pjfr-qf3p-3q25/GHSA-pjfr-qf3p-3q25.json |
| generic_textual | HIGH |
| Data source | Exploit-DB |
|---|---|
| Date added | Oct. 4, 2017 |
| Description | Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1) |
| Ransomware campaign use | Unknown |
| Source publication date | Sept. 20, 2017 |
| Exploit type | webapps |
| Platform | windows |
| Source update date | Oct. 4, 2017 |
| Source URL | https://bz.apache.org/bugzilla/show_bug.cgi?id=61542#c0 |
| Data source | KEV |
|---|---|
| Date added | March 25, 2022 |
| Description | When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. |
| Required action | Apply updates per vendor instructions. |
| Due date | April 15, 2022 |
| Note | https://nvd.nist.gov/vuln/detail/CVE-2017-12615 |
| Ransomware campaign use | Known |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T20:59:29Z/
Decision: Attend
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2017/12xxx/CVE-2017-12615.json
Source Advisory: vulnrichment/CVE-2017-12615
[{'Exploitation': 'active'},
{'Automatable': 'no'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]