LiveActive security incident?Get immediate response
CVE Record

CVE-2017-12615: When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g.

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

HighCVSS 8.1Known exploitedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A vulnerable Windows-based Apache Tomcat server can let an unauthenticated attacker place and run a malicious server-side file. Successful exploitation could expose data, alter applications, or disrupt the server. Only Tomcat 7.0.0 through 7.0.79 with HTTP PUT enabled is identified as affected.

Executive priority

Treat confirmed exposed configurations as urgent because exploitation can yield complete application-server compromise and CISA records known exploitation. Immediately locate affected Windows Tomcat systems, contain externally reachable instances, remediate the configuration or version, and investigate for prior compromise.

Technical view

CVE-2017-12615 is a CWE-434 unrestricted file-upload flaw. On Windows, affected Tomcat installations configured to permit HTTP PUT could accept a specially crafted JSP upload. Requesting that JSP would execute its code under the Tomcat process. The supplied CVSS 3.1 score is 8.1, with network access, no privileges, no user interaction, and high impact.

Likely exposure

Exposure requires Apache Tomcat 7.0.0–7.0.79 running on Windows with HTTP PUT enabled, such as DefaultServlet readonly set to false. Internet-accessible instances are the clearest concern. Other versions, operating systems, or configurations are not established as affected by the supplied evidence.

Exploitation context

CISA lists CVE-2017-12615 in its Known Exploited Vulnerabilities catalog, supporting real-world exploitation. Public exploit references also exist. The supplied bundle does not identify current campaigns, targeted organizations, exploitation volume, or observed indicators, so those details remain unknown.

Researcher notes

The vulnerability depends on a specific intersection: Windows, Tomcat 7.0.0–7.0.79, and enabled HTTP PUT. Assessments should verify all three rather than relying on version scanning alone. The bundle establishes code execution and known exploitation but provides no campaign-specific indicators or assurance that configuration changes alone remove evidence of prior compromise.

Mitigation direction

  • Identify and prioritize affected Windows Tomcat instances, especially those reachable from untrusted networks.
  • Disable unnecessary HTTP PUT capability and restore the DefaultServlet to read-only operation.
  • Upgrade to a vendor-supported Tomcat release outside the stated affected range, following Apache guidance.
  • Restrict external access until vulnerable versions and configurations are remediated.
  • Investigate potentially exposed systems for compromise before returning them to normal service.

Validation and detection

  • Inventory Tomcat versions, operating systems, network exposure, and DefaultServlet configurations.
  • Confirm unauthenticated HTTP PUT is rejected without attempting to upload executable content.
  • Review access logs for unusual PUT requests followed by JSP requests.
  • Search deployed web applications for unexpected or recently created JSP files.
  • Examine affected hosts for unexplained processes, file changes, accounts, or outbound connections.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-434: File access and web shell behavior lookup

File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2017-12615 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.1 (3.1)
Known Exploited
Yes
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
4Timeline events
2ADP providers
18Source links

CISA KEV status

Status
Known exploited
Source
CISA-ADP
Date added
KEV reference

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: activeAutomatable: noTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.1CVSS 3.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

8.1High
CVSS 3.1 vector shape for CVE-2017-12615Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. Added to KEVCISA-ADP

    CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.

  4. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvcother:kev

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Apache Software FoundationApache Tomcat7.0.0 to 7.0.79Listed
Weakness

CWE details

CWE-434

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-434 · source CWE mapping

Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs