CVE-2017-12615

Exploitation

Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalog on 2022-03-25. Federal remediation due 2022-04-15.

SSVC decision

• ExploitationactiveCISA reports credible evidence of active exploitation.
• AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
• Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

99.61% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 99.9% of scored records. A rank, not a probability.

NVD base score

8.1 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Analyzed. NVD last modified this record on 2026-08-06.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2017-09-19 13:00Z8 YR AGO

Last updated

2026-08-06 03:55Z29 DAYS AGO

Reserved

2017-08-07

Assigning CNA

apache

Record state

PUBLISHED

Severity

High (CVSS 8.1)

CNA CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

• CWE-434Unrestricted Upload of File with Dangerous TypeBase
• CWE-20Improper Input ValidationClass

Data version

5.2

Document digest

8f628469a59911b39955386a2ac6b60fddf98639e564e88fec14ce7be4166972

• access.redhat.comRHSA-2017:3113https://access.redhat.com/errata/RHSA-2017:3113vendor-advisoryx_refsource_REDHAT
• access.redhat.comRHSA-2017:3080https://access.redhat.com/errata/RHSA-2017:3080vendor-advisoryx_refsource_REDHAT
• www.securitytracker.com1039392http://www.securitytracker.com/id/1039392vdb-entryx_refsource_SECTRACK
• lists.apache.org[announce] 20170919 [SECURITY] CVE-2017-12615 Apache Tomcat Remote Code Execution via JSP uploadhttps://lists.apache.org/thread.html/8fcb1e2d5895413abcf266f011b9918ae03e0b7daceb118ffbf23f8c%40%3Cannounce.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• www.synology.comhttps://www.synology.com/support/security/Synology_SA_17_54_Tomcatx_refsource_CONFIRM
• access.redhat.comRHSA-2018:0465https://access.redhat.com/errata/RHSA-2018:0465vendor-advisoryx_refsource_REDHAT
• breaktoprotect.blogspot.comhttp://breaktoprotect.blogspot.com/2017/09/the-case-of-cve-2017-12615-tomcat-7-put.htmlx_refsource_MISC
• access.redhat.comRHSA-2017:3114https://access.redhat.com/errata/RHSA-2017:3114vendor-advisoryx_refsource_REDHAT
• www.securityfocus.com100901http://www.securityfocus.com/bid/100901vdb-entryx_refsource_BID
• access.redhat.comRHSA-2018:0466https://access.redhat.com/errata/RHSA-2018:0466vendor-advisoryx_refsource_REDHAT
• www.exploit-db.com42953https://www.exploit-db.com/exploits/42953/exploitx_refsource_EXPLOIT-DB
• security.netapp.comhttps://security.netapp.com/advisory/ntap-20171018-0001/x_refsource_CONFIRM
• github.comhttps://github.com/breaktoprotect/CVE-2017-12615x_refsource_MISC
• access.redhat.comRHSA-2017:3081https://access.redhat.com/errata/RHSA-2017:3081vendor-advisoryx_refsource_REDHAT
• lists.apache.org[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[announce] 20200131 Apache Software Foundation Security Report: 2019https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12615government-resource