Attacker Value
Unknown
CVE-2017-12617
CVE-2017-12617
(Last updated July 17, 2024) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Metasploit Module
Description
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
8.1 High
Impact Score:
5.9
Exploitability Score:
2.2
Attack Vector (AV):
Network
Attack Complexity (AC):
High
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High
General Information
Vendors
- apache,
- canonical,
- debian,
- netapp,
- oracle,
- redhat
Products
- active iq unified manager,
- agile plm 9.3.3,
- agile plm 9.3.4,
- agile plm 9.3.5,
- agile plm 9.3.6,
- communications instant messaging server 10.0.1,
- debian linux 7.0,
- element -,
- endeca information discovery integrator 3.1.0,
- endeca information discovery integrator 3.2.0,
- enterprise linux desktop 6.0,
- enterprise linux desktop 7.0,
- enterprise linux eus 7.4,
- enterprise linux eus 7.5,
- enterprise linux eus 7.6,
- enterprise linux eus 7.7,
- enterprise linux eus compute node 7.4,
- enterprise linux eus compute node 7.5,
- enterprise linux eus compute node 7.6,
- enterprise linux eus compute node 7.7,
- enterprise linux for ibm z systems 6.0 s390x,
- enterprise linux for ibm z systems 7.0 s390x,
- enterprise linux for ibm z systems eus 7.4 s390x,
- enterprise linux for ibm z systems eus 7.5 s390x,
- enterprise linux for ibm z systems eus 7.6 s390x,
- enterprise linux for ibm z systems eus 7.7 s390x,
- enterprise linux for power big endian 6.0 ppc64,
- enterprise linux for power big endian 7.0 ppc64,
- enterprise linux for power big endian eus 7.4 ppc64,
- enterprise linux for power big endian eus 7.5 ppc64,
- enterprise linux for power big endian eus 7.6 ppc64,
- enterprise linux for power big endian eus 7.7 ppc64,
- enterprise linux for power little endian 7.0,
- enterprise linux for power little endian eus 7.4 ppc64le,
- enterprise linux for power little endian eus 7.5 ppc64le,
- enterprise linux for power little endian eus 7.6 ppc64le,
- enterprise linux for power little endian eus 7.7 ppc64le,
- enterprise linux server 6.0,
- enterprise linux server 7.0,
- enterprise linux server aus 7.4,
- enterprise linux server aus 7.6,
- enterprise linux server aus 7.7,
- enterprise linux server tus 7.4,
- enterprise linux server tus 7.6,
- enterprise linux server tus 7.7,
- enterprise linux workstation 6.0,
- enterprise linux workstation 7.0,
- enterprise manager for mysql database 12.1.0.4.0,
- financial services analytical applications infrastructure,
- fmw platform 12.2.1.2.0,
- fmw platform 12.2.1.3.0,
- fuse 1.0,
- health sciences empirica inspections 1.0.1.1,
- hospitality guest access 4.2.0,
- hospitality guest access 4.2.1,
- instantis enterprisetrack 17.1,
- instantis enterprisetrack 17.2,
- jboss enterprise application platform 6.0.0,
- jboss enterprise application platform 6.4.0,
- jboss enterprise web server 2.0.0,
- jboss enterprise web server 3.0.0,
- jboss enterprise web server text-only advisories -,
- management pack 11.2.1.0.13,
- micros lucas 2.9.5,
- micros retail xbri loss prevention 10.0.1,
- micros retail xbri loss prevention 10.5.0,
- micros retail xbri loss prevention 10.6.0,
- micros retail xbri loss prevention 10.7.0,
- micros retail xbri loss prevention 10.8.0,
- micros retail xbri loss prevention 10.8.1,
- mysql enterprise monitor,
- oncommand balance -,
- oncommand insight -,
- oncommand shift -,
- oncommand workflow automation -,
- retail advanced inventory planning 13.2,
- retail advanced inventory planning 13.4,
- retail advanced inventory planning 14.1,
- retail advanced inventory planning 15.0,
- retail back office 14.0.4,
- retail back office 14.1.3,
- retail central office 14.0.4,
- retail central office 14.1.3,
- retail convenience and fuel pos software 2.1.132,
- retail eftlink 1.1.124,
- retail eftlink 15.0.1,
- retail eftlink 16.0.2,
- retail insights 14.0,
- retail insights 14.1,
- retail insights 15.0,
- retail insights 16.0,
- retail invoice matching 12.0,
- retail invoice matching 13.0,
- retail invoice matching 13.1,
- retail invoice matching 13.2,
- retail invoice matching 14.0,
- retail invoice matching 14.1,
- retail invoice matching 15.0,
- retail invoice matching 16.0,
- retail order broker 15.0,
- retail order broker 16.0,
- retail order broker 5.0,
- retail order broker 5.1,
- retail order broker 5.2,
- retail order management system 4.0,
- retail order management system 4.5,
- retail order management system 4.7,
- retail order management system 5.0,
- retail point-of-service 14.0.4,
- retail point-of-service 14.1.3,
- retail price management 12.0,
- retail price management 13.0,
- retail price management 13.1,
- retail price management 13.2,
- retail price management 14.0,
- retail price management 14.1,
- retail price management 15.0,
- retail price management 16.0,
- retail returns management 14.0.4,
- retail returns management 14.1.3,
- retail returns management 2.3.8,
- retail returns management 2.4.9,
- retail store inventory management 12.0.12,
- retail store inventory management 13.0.7,
- retail store inventory management 13.1.9,
- retail store inventory management 13.2.9,
- retail store inventory management 14.0.4,
- retail store inventory management 14.1.3,
- retail store inventory management 15.0.2,
- retail store inventory management 16.0.1,
- retail xstore point of service 15.0.1,
- retail xstore point of service 6.0.11,
- retail xstore point of service 7.0.6,
- retail xstore point of service 7.1.6,
- snapcenter -,
- tomcat,
- transportation management 6.3.1,
- transportation management 6.3.2,
- transportation management 6.3.3,
- transportation management 6.3.4,
- transportation management 6.3.5,
- transportation management 6.3.6,
- transportation management 6.3.7,
- tuxedo system and applications monitor 12.1.3.0.0,
- ubuntu linux 12.04,
- ubuntu linux 16.04,
- ubuntu linux 17.10,
- ubuntu linux 18.04,
- webcenter sites 11.1.1.8.0,
- workload manager 12.2.0.1
Metasploit Modules
Exploited in the Wild
References
Advisory
