CVE-2017-12616

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

• ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
• AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
• Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

70.11% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 99.3% of scored records. A rank, not a probability.

NVD base score

7.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD analysis status

Modified. NVD last modified this record on 2026-10-15.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2017-09-19 13:00Z9 YR AGO

Last updated

2026-10-15 15:52Z13 DAYS AGO

Reserved

2017-08-07

Assigning CNA

apache

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorClass

Data version

5.2

Document digest

46af9fa7b7db74eaac651a10c208f7ef56a00360520a75c1880d1fc6194dfb15

• www.securitytracker.com1039393http://www.securitytracker.com/id/1039393vdb-entryx_refsource_SECTRACK
• support.hpe.comhttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_usx_refsource_CONFIRM
• www.synology.comhttps://www.synology.com/support/security/Synology_SA_17_54_Tomcatx_refsource_CONFIRM
• access.redhat.comRHSA-2018:0465https://access.redhat.com/errata/RHSA-2018:0465vendor-advisoryx_refsource_REDHAT
• usn.ubuntu.comUSN-3665-1https://usn.ubuntu.com/3665-1/vendor-advisoryx_refsource_UBUNTU
• www.securityfocus.com100897http://www.securityfocus.com/bid/100897vdb-entryx_refsource_BID
• access.redhat.comRHSA-2018:0466https://access.redhat.com/errata/RHSA-2018:0466vendor-advisoryx_refsource_REDHAT
• security.netapp.comhttps://security.netapp.com/advisory/ntap-20171018-0001/x_refsource_CONFIRM
• lists.apache.org[announce] 20170919 [SECURITY] CVE-2017-12616 Apache Tomcat Information Disclosurehttps://lists.apache.org/thread.html/1df9b4552464caa42047062fe7175da0da06c18ecc8daf99258bbda6%40%3Cannounce.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• lists.debian.org[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security updatehttps://lists.debian.org/debian-lts-announce/2018/06/msg00008.htmlmailing-listx_refsource_MLIST
• lists.apache.org[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3Emailing-listx_refsource_MLIST