CVE-2017-12615

CISA KEV RANSOMWARE

ACT NOW Priority: 0.00 BB Relevance: 0/100

Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

CISA Known Exploited Vulnerability

Vendor / Product Apache — Tomcat

Date Added 2022-03-25

Remediation Due 2022-04-15

Ransomware Use CONFIRMED

https://nvd.nist.gov/vuln/detail/CVE-2017-12615

Weakness Classification (1)

CWE-434

Affected Software (50)

Vendor	Product	Version
apache	tomcat	7.0.0 – 7.0.79
netapp	7-mode_transition_tool	-
netapp	oncommand_balance	-
netapp	oncommand_shift	-
redhat	enterprise_linux_desktop	6.0
redhat	enterprise_linux_desktop	7.0
redhat	enterprise_linux_eus	7.4
redhat	enterprise_linux_eus	7.5
redhat	enterprise_linux_eus	7.6
redhat	enterprise_linux_eus	7.7
redhat	enterprise_linux_eus_compute_node	7.4
redhat	enterprise_linux_eus_compute_node	7.5
redhat	enterprise_linux_eus_compute_node	7.6
redhat	enterprise_linux_eus_compute_node	7.7
redhat	enterprise_linux_for_ibm_z_systems	7.0_s390x
redhat	enterprise_linux_for_ibm_z_systems_eus	7.4_s390x
redhat	enterprise_linux_for_ibm_z_systems_eus	7.5_s390x
redhat	enterprise_linux_for_ibm_z_systems_eus	7.6_s390x
redhat	enterprise_linux_for_ibm_z_systems_eus	7.7_s390x
redhat	enterprise_linux_for_power_big_endian	7.0_ppc64
redhat	enterprise_linux_for_power_big_endian_eus	7.4_ppc64
redhat	enterprise_linux_for_power_big_endian_eus	7.5_ppc64
redhat	enterprise_linux_for_power_big_endian_eus	7.6_ppc64
redhat	enterprise_linux_for_power_big_endian_eus	7.7_ppc64
redhat	enterprise_linux_for_power_little_endian	7.0_ppc64le
redhat	enterprise_linux_for_power_little_endian_eus	7.4_ppc64le
redhat	enterprise_linux_for_power_little_endian_eus	7.5_ppc64le
redhat	enterprise_linux_for_power_little_endian_eus	7.6_ppc64le
redhat	enterprise_linux_for_power_little_endian_eus	7.7_ppc64le
redhat	enterprise_linux_for_scientific_computing	7.0