CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Apache Tomcat Remote Code Execution Vulnerability via DefaultServlet readonly Parameter Misconfiguration (CVE-2017-12617)
[Affected Scope] Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46, and 7.0.0 to 7.0.81 when the 'readonly' parameter of the DefaultServlet is set to false
[Impact] Unauthenticated remote attackers can upload malicious JSP files using crafted HTTP PUT requests, leading to arbitrary code execution with the privileges of the Tomcat process
[Mitigation] Upgrade Apache Tomcat to the latest secure versions, or modify the web.xml configuration to ensure the 'readonly' parameter is set to true (default)
Apache Tomcat 7.0.x Windows Remote Code Execution Vulnerability (CVE-2017-12615) Security Advisory
[Affected Scope] Apache Tomcat versions 7.0.0 to 7.0.79 running on Windows with the 'readonly' initialization parameter set to 'false'.
[Impact] Unauthenticated remote attackers can upload malicious JSP files via specially crafted HTTP PUT requests, leading to arbitrary code execution under the context of the Tomcat process.
[Mitigation] Immediately upgrade Apache Tomcat to version 7.0.81 or later, or revert the 'readonly' parameter to 'true' in the web.xml configuration.