CVE-2017-5648

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

• ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
• AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
• Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

13.22% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 96.1% of scored records. A rank, not a probability.

NVD base score

9.1 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

NVD analysis status

Modified. NVD last modified this record on 2026-10-15.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2017-04-17 16:00Z9 YR AGO

Last updated

2026-10-15 15:56Z13 DAYS AGO

Reserved

2017-01-29

Assigning CNA

apache

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

• CWE-668Exposure of Resource to Wrong SphereClass

Data version

5.2

Document digest

86feddebe2932c30b93f51b22dca9d38eff785accdd2125cc038a107a5042985

• lists.apache.org[users] 20170410 [SECURITY] CVE-2017-5648 Apache Tomcat Information Disclosurehttps://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• security.gentoo.orgGLSA-201705-09https://security.gentoo.org/glsa/201705-09vendor-advisoryx_refsource_GENTOO
• security.netapp.comhttps://security.netapp.com/advisory/ntap-20180614-0001/x_refsource_CONFIRM
• www.securityfocus.com97530http://www.securityfocus.com/bid/97530vdb-entryx_refsource_BID
• access.redhat.comRHSA-2017:1801https://access.redhat.com/errata/RHSA-2017:1801vendor-advisoryx_refsource_REDHAT
• www.debian.orgDSA-3843http://www.debian.org/security/2017/dsa-3843vendor-advisoryx_refsource_DEBIAN
• www.securitytracker.com1038220http://www.securitytracker.com/id/1038220vdb-entryx_refsource_SECTRACK
• www.debian.orgDSA-3842http://www.debian.org/security/2017/dsa-3842vendor-advisoryx_refsource_DEBIAN
• access.redhat.comRHSA-2017:1809https://access.redhat.com/errata/RHSA-2017:1809vendor-advisoryx_refsource_REDHAT
• access.redhat.comRHSA-2017:1802https://access.redhat.com/errata/RHSA-2017:1802vendor-advisoryx_refsource_REDHAT
• lists.apache.org[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3Emailing-listx_refsource_MLIST
• www.openwall.com[oss-security] 20200720 CVE-2020-13932 Apache ActiveMQ Artemis - Remote XSS in Web console Diagram Pluginhttp://www.openwall.com/lists/oss-security/2020/07/20/8mailing-listx_refsource_MLIST