Apache · Tomcat
CVE-2017-12615
Apache Tomcat on Windows Remote Code Execution Vulnerability
O que é
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CISA: When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
O que fazer
Apply updates per vendor instructions.
Prazo para as agências federais dos EUA: 15 de abril de 2022
- Adicionada à lista da CISA
- 25 de março de 2022
- Publicada
- 19 de setembro de 2017
- Gravidade
- Alto 8,1 CVSS 3.1
- Chance de ataques nos próximos 30 dias (EPSS)
- 99,7% entre os 0,1% mais altos de todas as vulnerabilidades conhecidas
- Fraqueza
- CWE-434
- Mais detalhes
- NVD · CVE.org · CISA
Todas as referências (19)
- https://access.redhat.com/errata/RHSA-2017:3113
- https://access.redhat.com/errata/RHSA-2017:3080
- https://access.redhat.com/errata/RHSA-2018:0465
- https://access.redhat.com/errata/RHSA-2017:3114
- https://access.redhat.com/errata/RHSA-2018:0466
- https://access.redhat.com/errata/RHSA-2017:3081
- http://www.securitytracker.com/id/1039392
- https://lists.apache.org/thread.html/8fcb1e2d5895413abcf266f011b9918ae03e0b7daceb118ffbf23f8c%40%3Cannounce.t…
- https://www.synology.com/support/security/Synology_SA_17_54_Tomcat
- http://breaktoprotect.blogspot.com/2017/09/the-case-of-cve-2017-12615-tomcat-7-put.html
- http://www.securityfocus.com/bid/100901
- https://www.exploit-db.com/exploits/42953/
- https://security.netapp.com/advisory/ntap-20171018-0001/
- https://github.com/breaktoprotect/CVE-2017-12615
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat…
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat…
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat…
- https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.…
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomca…
Mais falhas exploradas de Apache
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 4 de ago. de 2026 | Missing Encryption of Sensitive Data | Tomcat | Alto 7,5 | 99% |
| 1 de abr. de 2025 | Path Equivalence | Tomcat | Crítica 10,0 | 99,9% |
| 12 de mai. de 2023 | Remote Code Execution | Tomcat | Crítica 9,8 | 90% |
| 25 de mar. de 2022 | Remote Code Execution | Tomcat | Alto 8,1 | >99,9% |
| 3 de mar. de 2022 | Improper Privilege Management | Tomcat | Crítica 9,8 | 99,3% |
| 8 de out. de 2026 | Command Injection | Struts | Alto 8,1 | 97% |
| 16 de abr. de 2026 | Improper Input Validation | ActiveMQ | Alto 8,8 | 98% |
| 1 de mai. de 2025 | Improper Escaping of Output | HTTP Server | Crítica 9,1 | >99,9% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.