CVE-2017-12617

HIGH(8.1)KEVLikely Exploited

Apache Tomcat Remote Code Execution Vulnerability

Description

CVE-2017-12617 is a high-severity file upload vulnerability affecting Apache Tomcat. When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. An attacker can exploit this flaw without authentication over the network. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.36% (100.0th percentile) indicates a significantly elevated exploitation probability.

KEV Information

Vendor
Apache
Product
Tomcat
Date Added
March 25, 2022
Due Date
April 15, 2022
Required Action
Apply updates per vendor instructions.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
2.2
Impact Score
5.9

CWEs

CWE-434Unrestricted Upload

Unrestricted Upload of File with Dangerous Type

Affected Products

VendorProductVersion
apachetomcat>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1
canonicalubuntu linux12.04; 16.04; 17.10; 18.04
oracleagile plm9.3.3; 9.3.4; 9.3.5; 9.3.6
oraclecommunications instant messaging server10.0.1
oracleendeca information discovery integrator3.1.0; 3.2.0
oracleenterprise manager for mysql database12.1.0.4.0
oraclefinancial services analytical applications infrastructure>= 7.3.3.0.0, <= 7.3.5.3.0; >= 8.0.0.0.0, <= 8.0.9.0.0
oraclefmw platform12.2.1.2.0; 12.2.1.3.0
oraclehealth sciences empirica inspections1.0.1.1
oraclehospitality guest access4.2.0; 4.2.1
oracleinstantis enterprisetrack17.1; 17.2
oraclemanagement pack11.2.1.0.13
oraclemicros lucas2.9.5
oraclemicros retail xbri loss prevention10.0.1; 10.5.0; 10.6.0; 10.7.0; 10.8.0; 10.8.1
oraclemysql enterprise monitor<= 3.3.6.3293; >= 3.4.0, <= 3.4.4.4226; >= 4.0.0, <= 4.0.0.5135
oracleretail advanced inventory planning13.2; 13.4; 14.1; 15.0
oracleretail back office14.0.4; 14.1.3
oracleretail central office14.0.4; 14.1.3
oracleretail convenience and fuel pos software2.1.132
oracleretail eftlink1.1.124; 15.0.1; 16.0.2

Multiple CVSS Assessments

Source: [email protected](Primary)
8.1
HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0(Secondary)
8.1
HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Weakness Type

CWE-434: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type occurs when software allows users to upload files without properly validating, restricting, or handling the file types. Attackers can upload files with dangerous content such as web shells, scripts, or executables that can be executed on the server. In the case of CVE-2017-12617, this weakness allows attackers to compromise Apache Tomcat systems.

Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type

Impact Analysis

CVE-2017-12617 carries a CVSS 3.1 base score of 8.1 (HIGH), reflecting the serious risk it poses to affected environments. Successful exploitation can lead to complete compromise of data confidentiality, full system integrity compromise, and complete denial of service. The attack vector is network-based with high complexity, meaning exploitation requires specific conditions to be met. Organizations running Apache Tomcat face tangible risk of unauthorized access, data breaches, and operational disruption if this vulnerability remains unpatched.

Exploit Maturity

CVE-2017-12617 is listed in the CISA Known Exploited Vulnerabilities catalog with a remediation deadline of 2022-04-15, confirming that real-world exploitation has been observed. The EPSS score of 94.36% (100.0th percentile) places this vulnerability among those most likely to be exploited. Public exploit code is available in vulnerability databases, lowering the barrier for attackers and increasing the urgency of remediation.

Remediation

  1. Apply updates per vendor instructions. This is the CISA-mandated remediation action and should be prioritized immediately.
  2. If patches cannot be applied immediately, restrict network access to the affected Tomcat management interfaces to only trusted administrative networks using firewall rules or access control lists.
  3. Monitor vendor security advisories for additional updates and ensure a patch management process is in place for timely deployment.
  4. Conduct a thorough review of affected systems for signs of prior compromise, including unexpected user accounts, modified configurations, and unusual network activity.
  5. Implement defense-in-depth measures including network segmentation, intrusion detection systems, and continuous security monitoring for the affected infrastructure.

Technical Details

CVE-2017-12617 is exploitable remotely over the network without any prior authentication. When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. The attack complexity is rated high, meaning specific conditions must be met for successful exploitation. The scope is unchanged, meaning the impact is confined to the vulnerable component. The CVSS 3.1 base score of 8.1 reflects the combination of these factors and the potential for significant damage to affected systems.

Frequently Asked Questions

Is CVE-2017-12617 being actively exploited?

Yes. CISA has confirmed active exploitation by adding CVE-2017-12617 to the Known Exploited Vulnerabilities catalog. The EPSS score of 94.36% (100.0th percentile) further indicates high exploitation likelihood.

What products are affected by CVE-2017-12617?

CVE-2017-12617 affects Apache Tomcat. Specifically, affected products include apache tomcat, canonical ubuntu linux, oracle agile plm, oracle communications instant messaging server, oracle endeca information discovery integrator, and others.

How do I fix CVE-2017-12617?

Apply updates per vendor instructions. Ensure your systems are updated to the latest patched version. If immediate patching is not feasible, restrict network access to the affected system's management interfaces.

How severe is CVE-2017-12617?

CVE-2017-12617 has a CVSS 3.1 score of 8.1 (HIGH). This is a high-severity vulnerability that poses significant risk and requires prompt remediation. The vulnerability enables unauthenticated remote attackers to potentially compromise affected Tomcat systems.

CVSS Score

8.1
HIGH(8.1)

EPSS Score

EPSS Score99.99%
EPSS Percentile100.0%

Dates

PublishedOctober 4, 2017
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch