CVE-2017-12615
Apache Tomcat on Windows Remote Code Execution Vulnerability
CVSS
8.1
Alta
EPSS
99.7%
p100
KEV
SIM
25 de mar. de 2022
Exploit Today
80
0-100
Publicado: 19 de set. de 2017 · Última mod.: 6 de ago. de 2026 · CWE-434
99.6%EPSS · 30 dias99.7%
2026-10-082026-11-05
Produto
Apache / Tomcat
Vulnerabilidade
Apache Tomcat on Windows Remote Code Execution Vulnerability
Adicionado ao KEV
25 de mar. de 2022
Corrigir até
15 de abr. de 2022
Uso conhecido em ransomware
Sim
Descrição resumida
When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Ação necessária
Apply updates per vendor instructions.
Notas
https://nvd.nist.gov/vuln/detail/CVE-2017-12615
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
- breaktoprotect.blogspot.comhttp://breaktoprotect.blogspot.com/2017/09/the-case-of-cve-2017-12615-tomcat-7-put.html
- www.securityfocus.comhttp://www.securityfocus.com/bid/100901
- www.securitytracker.comhttp://www.securitytracker.com/id/1039392
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2017:3080
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2017:3081
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2017:3113
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2017:3114
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2018:0465
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2018:0466
- github.comhttps://github.com/breaktoprotect/CVE-2017-12615
- lists.apache.orghttps://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
- lists.apache.orghttps://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E
- lists.apache.orghttps://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E
- lists.apache.orghttps://lists.apache.org/thread.html/8fcb1e2d5895413abcf266f011b9918ae03e0b7daceb118ffbf23f8c%40%3Cannounce.tomcat.apache.org%3E
- lists.apache.orghttps://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
- lists.apache.orghttps://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20171018-0001/
- www.exploit-db.comhttps://www.exploit-db.com/exploits/42953/
- www.synology.comhttps://www.synology.com/support/security/Synology_SA_17_54_Tomcat
- breaktoprotect.blogspot.comhttp://breaktoprotect.blogspot.com/2017/09/the-case-of-cve-2017-12615-tomcat-7-put.html
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1220477.3 ALT22.2%
——7A security vulnerability has been detected in Campcodes Complete Advance Loan Management System 1.0. This affects the function move_uploaded_file of the file /loan/application/banner.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.1dCVE-2026-1221209.0 CRÍ43.9%
——13In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.7hCVE-2026-1152436.7 MÉD23.9%
——7The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking disabled, so an authenticated administrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137's import directory. This is an incomplete fix of CVE-2025-5961, whose extension check was applied to the wrong value.1dCVE-2026-1217335.4 MÉD7.8%
——2Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it.1dCVE-2026-733287.2 ALT53.6%
——16Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.2dCVE-2026-761248.8 ALT38.2%
——11The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. While uploaded files are deleted after email transmission, a race condition exists during SMTP execution that allows access to the file, and files persist indefinitely when wp_mail() fails.3d