vulnerability
Oracle Linux: CVE-2017-12617: ELSA-2017-3081: tomcat security update (IMPORTANT) (Multiple Advisories)
Severity | CVSS | Published | Added | Modified |
---|---|---|---|---|
8 | (AV:N/AC:H/Au:N/C:C/I:C/A:C) | Sep 21, 2017 | Oct 30, 2017 | Feb 10, 2025 |
Severity
8
CVSS
(AV:N/AC:H/Au:N/C:C/I:C/A:C)
Published
Sep 21, 2017
Added
Oct 30, 2017
Modified
Feb 10, 2025
Description
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution.
A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution.
Solution(s)
oracle-linux-upgrade-tomcatoracle-linux-upgrade-tomcat6oracle-linux-upgrade-tomcat6-admin-webappsoracle-linux-upgrade-tomcat6-docs-webapporacle-linux-upgrade-tomcat6-el-2-1-apioracle-linux-upgrade-tomcat6-javadocoracle-linux-upgrade-tomcat6-jsp-2-1-apioracle-linux-upgrade-tomcat6-liboracle-linux-upgrade-tomcat6-servlet-2-5-apioracle-linux-upgrade-tomcat6-webappsoracle-linux-upgrade-tomcat-admin-webappsoracle-linux-upgrade-tomcat-docs-webapporacle-linux-upgrade-tomcat-el-2-2-apioracle-linux-upgrade-tomcat-javadocoracle-linux-upgrade-tomcat-jsp-2-2-apioracle-linux-upgrade-tomcat-jsvcoracle-linux-upgrade-tomcat-liboracle-linux-upgrade-tomcat-servlet-3-0-apioracle-linux-upgrade-tomcat-webapps

NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.