CVE-2017-12615

KEVRansomware UseApache Tomcat on Windows Remote Code Execution Vulnerability

Description

When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

PublishedSep 19, 2017

Last modifiedAug 6, 2026

Added to KEVMar 25, 2022

Remediation dueApr 15, 2022

References

breaktoprotect.blogspot.com/2017/09/the-case-of-cve-2017-12615-tomcat-7-put.htmlExploit
securityfocus.com/bid/100901Broken LinkThird Party Advisory
securitytracker.com/id/1039392Broken LinkThird Party Advisory
access.redhat.com/errata/RHSA-2017:3080Third Party Advisory
access.redhat.com/errata/RHSA-2017:3081Third Party Advisory
access.redhat.com/errata/RHSA-2017:3113Third Party Advisory
access.redhat.com/errata/RHSA-2017:3114Third Party Advisory
access.redhat.com/errata/RHSA-2018:0465Third Party Advisory
access.redhat.com/errata/RHSA-2018:0466Third Party Advisory
github.com/breaktoprotect/CVE-2017-12615ExploitThird Party Advisory
lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3EMailing ListPatch
lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3EMailing ListPatch

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited and used by ransomware crews. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1656 days
Ransomware: Used in known ransomware campaigns
CVSS: 8.1 HIGH
EPSS (30-day exploit probability): 99.7% · top 1% of all CVEs
Weakness: CWE-434
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
5.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.