What is the CVSS score of CVE-2017-12615?

CVE-2017-12615 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 94.2%.

Is there a public PoC exploit available for CVE-2017-12615?

Yes, a public proof-of-concept exploit is available for CVE-2017-12615. Prioritise patching immediately. EPSS: 94.2%.

Is there a patch available for CVE-2017-12615?

Yes, a patch is available for CVE-2017-12615. Update the affected software to the latest version immediately.

Tomcat CVE-2017-12615

HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2017-09-19 security@apache.org

Apache Microsoft Tomcat File Upload 7 Mode Transition Tool Oncommand Balance Oncommand Shift Enterprise Linux Server Update Services For Sap Solutions Jboss Enterprise Web Server Jboss Enterprise Web Server Text Only Advisories Enterprise Linux Desktop Enterprise Linux Eus Enterprise Linux Eus Compute Node Enterprise Linux For Ibm Z Systems Enterprise Linux For Ibm Z Systems Eus Enterprise Linux For Power Big Endian Enterprise Linux For Power Big Endian Eus Enterprise Linux For Power Little Endian Enterprise Linux For Power Little Endian Eus Enterprise Linux For Scientific Computing Enterprise Linux Server Enterprise Linux Server Aus Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions Enterprise Linux Server Tus Enterprise Linux Workstation

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Apr 21, 2026 - 15:31 CISA

CVE Published

Sep 19, 2017 - 13:29 cve.org

HIGH 8.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 maven packages depend on org.apache.tomcat.embed:tomcat-embed-core (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionNVD

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

AnalysisAI

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. Affected products include: Apache Tomcat, Netapp 7-Mode Transition Tool, Netapp Oncommand Balance, Netapp Oncommand Shift, Redhat Enterprise Linux Server Update Services For Sap Solutions.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.