8.1Hoch KEV

CVE-2017-12617Apache Tomcat Remote Code Execution Vulnerability

Apache Software Foundation Apache Tomcat Veröffentlicht: 2017-10-03 18:00 (vor 9 Jahren)

Bekannt ausgenutzt — Apache Tomcat Remote Code Execution Vulnerability

CISA hat am 25.03.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 15.04.2022.

Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2017-12617

Beschreibung

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Schwachstellentyp (CWE): CWE-434

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
Apache Software Foundation	Apache Tomcat	9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46, 7.0.0 to 7.0.81
apache	tomcat	7.0.0 – < 7.0.82
canonical	ubuntu linux	12.04
debian	debian linux	7.0
netapp	active iq unified manager	7.3 –
netapp	element	—
netapp	oncommand balance	—
netapp	oncommand insight	—
netapp	oncommand shift	—
netapp	oncommand workflow automation	—
netapp	snapcenter	—
oracle	agile product lifecycle management	9.3.3
oracle	communications instant messaging server	10.0.1
oracle	endeca information discovery integrator	3.1.0
oracle	enterprise manager for mysql database	12.1.0.4.0
oracle	financial services analytical applications infrastructure	7.3.3.0.0 – ≤ 7.3.5.3.0
oracle	fmw platform	12.2.1.2.0
oracle	health sciences empirica inspections	1.0.1.1
oracle	hospitality guest access	4.2.0
oracle	instantis enterprisetrack	17.1
oracle	management pack	11.2.1.0.13
oracle	micros lucas	2.9.5
oracle	micros retail xbri loss prevention	10.0.1
oracle	mysql enterprise monitor	≤ 3.3.6.3293
oracle	retail advanced inventory planning	13.2
oracle	retail back office	14.0.4
oracle	retail central office	14.0.4
oracle	retail convenience and fuel pos software	2.1.132
oracle	retail eftlink	1.1.124
oracle	retail insights	14.0
oracle	retail invoice matching	12.0
oracle	retail order broker	5.0
oracle	retail order management system	4.0
oracle	retail point-of-service	14.0.4
oracle	retail price management	12.0
oracle	retail returns management	2.3.8
oracle	retail store inventory management	12.0.12
oracle	retail xstore point of service	6.0.11
oracle	transportation management	6.3.1
oracle	tuxedo system and applications monitor	12.1.3.0.0
oracle	webcenter sites	11.1.1.8.0
oracle	workload manager	12.2.0.1
redhat	enterprise linux desktop	6.0
redhat	enterprise linux eus	7.4
redhat	enterprise linux eus compute node	7.4
redhat	enterprise linux for ibm z systems	6.0_s390x
redhat	enterprise linux for ibm z systems eus	7.4_s390x
redhat	enterprise linux for power big endian	6.0_ppc64
redhat	enterprise linux for power big endian eus	7.4_ppc64
redhat	enterprise linux for power little endian	7.0
redhat	enterprise linux for power little endian eus	7.4_ppc64le
redhat	enterprise linux server	6.0
redhat	enterprise linux server aus	7.4
redhat	enterprise linux server tus	7.4
redhat	enterprise linux workstation	6.0
redhat	fuse	1.0
redhat	jboss enterprise application platform	6.0.0
redhat	jboss enterprise web server	2.0.0
redhat	jboss enterprise web server text-only advisories	—

Referenzen und Patches

RHSA-2017:3113 vendor-advisoryThird Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html PatchThird Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html PatchThird Party Advisory
RHSA-2017:3080 vendor-advisoryThird Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us Third Party Advisory
RHSA-2018:0269 vendor-advisoryThird Party Advisory
42966 exploitExploitThird Party AdvisoryVDB Entry
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03812en_us Third Party Advisory
RHSA-2018:0270 vendor-advisoryThird Party Advisory
RHSA-2018:0271 vendor-advisoryThird Party Advisory
[debian-lts-announce] 20171107 [SECURITY] [DLA 1166-1] tomcat7 security update mailing-listMailing ListThird Party Advisory
RHSA-2018:2939 vendor-advisoryThird Party Advisory
RHSA-2018:0465 vendor-advisoryThird Party Advisory
USN-3665-1 vendor-advisoryThird Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html PatchThird Party Advisory
RHSA-2018:0268 vendor-advisoryThird Party Advisory
RHSA-2017:3114 vendor-advisoryThird Party Advisory
43008 exploitExploitThird Party AdvisoryVDB Entry
1039552 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
100954 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
RHSA-2018:0275 vendor-advisoryThird Party Advisory
RHSA-2018:0466 vendor-advisoryThird Party Advisory
[announce] 20171003 [SECURITY] CVE-2017-12617 Apache Tomcat Remote Code Execution via JSP upload mailing-listIssue TrackingMailing List
https://security.netapp.com/advisory/ntap-20171018-0002/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20180117-0002/ Third Party Advisory
RHSA-2017:3081 vendor-advisoryThird Party Advisory
[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-listMailing ListPatch
[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-listMailing ListPatch
[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-listMailing ListPatch
[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-listMailing ListPatch
[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-listMailing ListPatch
https://support.f5.com/csp/article/K53173544 Third Party Advisory
[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-listMailing ListPatch
[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-listMailing ListPatch
[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-listMailing ListPatch
[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-listMailing ListPatch
[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-listMailing ListPatch
[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-listMailing ListPatch
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html PatchThird Party Advisory
[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ mailing-listMailing ListPatch
[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ mailing-listMailing ListPatch
[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-listMailing ListPatch
[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ mailing-listMailing ListPatch
[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ mailing-listMailing ListPatch
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12617 US Government Resource

CPE-Treffer (NVD) (60)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.82
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 8.0 < 8.0.47
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 8.5.0 < 8.5.23
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 9.0.0 < 9.0.1
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_for_mysql_database:12.1.0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* ≥ 7.3.3.0.0 ≤ 7.3.5.3.0
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* ≥ 8.0.0.0.0 ≤ 8.0.9.0.0
cpe:2.3:a:oracle:fmw_platform:12.2.1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:fmw_platform:12.2.1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:health_sciences_empirica_inspections:1.0.1.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:management_pack:11.2.1.0.13:*:*:*:*:goldengate:*:*
cpe:2.3:a:oracle:micros_lucas:2.9.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.5.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.6.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:micros_retail_xbri_loss_prevention:10.8.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* ≤ 3.3.6.3293
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* ≥ 3.4.0 ≤ 3.4.4.4226
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* ≥ 4.0.0 ≤ 4.0.0.5135
cpe:2.3:a:oracle:retail_advanced_inventory_planning:13.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_advanced_inventory_planning:13.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_advanced_inventory_planning:14.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_advanced_inventory_planning:15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_back_office:14.0.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_back_office:14.1.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_central_office:14.0.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_central_office:14.1.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_convenience_and_fuel_pos_software:2.1.132:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_eftlink:1.1.124:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_eftlink:15.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_eftlink:16.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_insights:14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_insights:14.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_insights:15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_insights:16.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_invoice_matching:12.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_invoice_matching:13.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_invoice_matching:13.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_invoice_matching:13.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_invoice_matching:14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_invoice_matching:14.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_invoice_matching:15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_invoice_matching:16.0:*:*:*:*:*:*:*

CVSS-Score

8.1Hoch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Hoch
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Alle Scores (4)

CISA-ADP	CVSS 3.1	8.1Hoch
nvd	CVSS 3.1	8.1Hoch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	8.1Hoch
nvd	CVSS 2.0	6.8Mittel

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

99.97%

höher als 100 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: active
Automatisierbar: no
Technische Auswirkung: total

Zeitverlauf

ID reserviert2017-08-07
Veröffentlicht2017-10-03 18:00
Bei IP-DB eingegangen2026-10-24 23:33
In KEV aufgenommen2022-03-25
Zuletzt aktualisiert2026-08-25 19:28

Vergeben von (CNA): apache
NVD-Status: Analyzed

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar