When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Tomcat | — | Upgrade Apache Tomcat to 7.0.81Upgrade Apache Tomcat to the latest available version | Sep 21, 2017 | Sep 19, 2017 |
| Centos_linux | — | Upgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcatUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat6-docs-webappUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat6-javadocUpgrade tomcat-docs-webappUpgrade tomcat6-libUpgrade tomcat-webappsUpgrade tomcat6-jsp-2.1-apiUpgrade tomcat-jsvcUpgrade tomcat6Upgrade tomcat-libUpgrade tomcat6-admin-webappsUpgrade tomcat6-webappsUpgrade tomcat6-el-2.1-api | Oct 30, 2017 | Sep 19, 2017 |
| Freebsd | — | Upgrade payara | Nov 29, 2018 | Nov 28, 2018 |
| Huawei Euleros 2_0_sp1 | — | Upgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-lib | Nov 30, 2017 | Sep 19, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webapps | Nov 30, 2017 | Sep 19, 2017 |
| Oracle_linux | — | Upgrade tomcat6-javadocUpgrade tomcat-javadocUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat6-docs-webappUpgrade tomcat-jsp-2.2-apiUpgrade tomcat6-libUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-el-2.2-apiUpgrade tomcat6-jsp-2.1-apiUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat6Upgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade tomcat6-admin-webappsUpgrade tomcat6-webappsUpgrade tomcat6-el-2.1-api | Oct 30, 2017 | Sep 19, 2017 |
| Redhat_linux | — | Upgrade tomcat-admin-webappsUpgrade tomcat6-admin-webappsUpgrade tomcat6-libUpgrade tomcat6-javadocUpgrade tomcat-el-2.2-apiUpgrade tomcat6-jsp-2.1-apiUpgrade tomcat-libUpgrade tomcat6-docs-webappUpgrade tomcat-jsvcUpgrade tomcat6-el-2.1-apiUpgrade tomcat-javadocUpgrade tomcatUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat6-webappsUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat6 | Oct 30, 2017 | Sep 19, 2017 |
| Suse | — | Upgrade tomcat-javadocUpgrade tomcat-jsp-2_2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-docs-webappUpgrade tomcat-servlet-3_0-apiUpgrade tomcat-webappsUpgrade tomcat-el-2_2-apiUpgrade tomcat-libUpgrade tomcat | Nov 23, 2017 | Sep 19, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub