CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2017-10-04
Apache Tomcat Remote Code Execution Vulnerability via DefaultServlet readonly Parameter Misconfiguration (CVE-2017-12617)
[Affected Scope] Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46, and 7.0.0 to 7.0.81 when the 'readonly' parameter of the DefaultServlet is set to false
[Impact] Unauthenticated remote attackers can upload malicious JSP files using crafted HTTP PUT requests, leading to arbitrary code execution with the privileges of the Tomcat process
[Mitigation] Upgrade Apache Tomcat to the latest secure versions, or modify the web.xml configuration to ensure the 'readonly' parameter is set to true (default)