What is the CVSS score of CVE-2017-12617?

CVE-2017-12617 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 94.4%.

Is there a public PoC exploit available for CVE-2017-12617?

Yes, a public proof-of-concept exploit is available for CVE-2017-12617. Prioritise patching immediately. EPSS: 94.4%.

Is there a patch available for CVE-2017-12617?

Yes, a patch is available for CVE-2017-12617. Update the affected software to the latest version immediately.

Tomcat CVE-2017-12617

HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2017-10-04 security@apache.org

Apache Debian Oracle Red Hat Tomcat File Upload Canonical Active Iq Unified Manager Debian Linux Enterprise Linux Desktop Enterprise Linux Eus Enterprise Linux For Ibm Z Systems Enterprise Linux For Ibm Z Systems Eus Enterprise Linux For Power Big Endian Enterprise Linux For Power Little Endian Enterprise Linux For Power Little Endian Eus Enterprise Linux Server Enterprise Linux Server Aus Enterprise Linux Server Tus Enterprise Linux Workstation Fuse Jboss Enterprise Application Platform Oncommand Insight Oncommand Workflow Automation Ubuntu Linux Element Snapcenter Financial Services Analytical Applications Infrastructure Retail Back Office Retail Returns Management Mysql Enterprise Monitor Workload Manager Enterprise Linux For Power Big Endian Eus Oncommand Balance Oncommand Shift Jboss Enterprise Web Server Agile Plm Communications Instant Messaging Server Hospitality Guest Access Micros Retail Xbri Loss Prevention Retail Convenience And Fuel Pos Software Transportation Management Jboss Enterprise Web Server Text Only Advisories Enterprise Linux Eus Compute Node Endeca Information Discovery Integrator Enterprise Manager For Mysql Database Fmw Platform Health Sciences Empirica Inspections Instantis Enterprisetrack Management Pack Micros Lucas Retail Advanced Inventory Planning Retail Central Office Retail Eftlink Retail Insights Retail Invoice Matching Retail Order Broker Retail Order Management System Retail Point Of Service Retail Price Management Retail Store Inventory Management Retail Xstore Point Of Service Tuxedo System And Applications Monitor Webcenter Sites Netapp

8.1

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-434 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V5 - File Handling File type validation, storage isolation MITRE ATT&CK 2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS score of 8.1 (HIGH). Attack characteristics: network attack vector, high complexity, no privileges required, no user interaction not required. CISA has confirmed active exploitation in the wild. Public proof-of-concept exploit code is available. EPSS exploitation probability: 94.36%.
Exploit ScenarioDerived	A remote attacker could upload malicious files that can be executed on the server by sending crafted requests to the affected application. No authentication is required to exploit this vulnerability.

Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.

Exploited in the wild (CISA KEV) Patch available 94.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

Affected Packages

maven org.apache.tomcat.embed:tomcat-embed-core fix: 7.0.82, 8.0.47, 8.5.23, 9.0.1

maven org.apache.tomcat:tomcat-catalina fix: 7.0.82, 8.0.47, 8.5.23, 9.0.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in maven

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. Affected products include: Apache Tomcat, Canonical Ubuntu Linux, Oracle Agile Plm, Oracle Communications Instant Messaging Server, Oracle Endeca Information Discovery Integrator.

Know when Tomcat gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Apr 21, 2026 - 15:31 CISA

CVE Published

Oct 04, 2017 - 01:29 cve.org

HIGH 8.1

DescriptionNVD

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 maven packages depend on org.apache.tomcat.embed:tomcat-embed-core (3 direct, 0 indirect)
4 maven packages depend on org.apache.tomcat:tomcat-catalina (4 direct, 0 indirect)

Ecosystem-wide dependent count for version 9.0.0.M1 and other introduced versions.

Threat Intelligence Overview

Threat Score

7.5/10

Composite threat intelligence

EPSS Score

94.4%

Top 0% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

NVD

CVE.org

CISA KEV

EPSS POC (2)

Exploit-DB

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV Yes

Public POC Yes

EPSS 94.4%

Patch available Yes

Active threat Yes

Deciding rule

In CISA KEV with patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Active

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

High

Priority Score

219

Low Medium High Critical

KEV: +50

EPSS: +94

CVSS: +40

PoC: +20

Weaponized: +15

Threat intel: 0

Gov advisory: 0

Attack Technique

Malicious File Upload HIGH

Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.

Affected Products (CPE)NVD

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*

cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:agile_plm:9.3.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_manager_for_mysql_database:12.1.0.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*

cpe:2.3:a:oracle:fmw_platform:12.2.1.2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:fmw_platform:12.2.1.3.0:*:*:*:*:*:*:*

+ 137 more

More in Tomcat

View all

CVE-2020-1938 CRITICAL Act Now POC

9.8 Feb 24

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate

CVE-2023-47246 CRITICAL Emergency POC

9.8 Nov 10

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f

CVE-2016-8735 CRITICAL Act Now POC

9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8

CVE-2017-12615 HIGH Act Now POC

8.1 Sep 19

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this

CVE-2023-44487 HIGH Act Now POC

7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2014-0050 HIGH Act Now POC

7.5 Apr 01

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,

CVE-2020-13935 HIGH Act Now POC

7.5 Jul 14

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to

CVE-2018-11784 MEDIUM This Month POC

4.3 Oct 04

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a r

CVE-2022-29885 HIGH Act Now POC

7.5 May 12

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78

CVE-2017-12616 HIGH Act Now

7.5 Sep 19

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or

CVE-2020-9484 HIGH Act Now POC

7.0 May 20

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)

CVE-2014-0227 MEDIUM This Month

6.4 Feb 16

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all

CVE-2016-3088 CRITICAL POC

9.8

CVE-2021-31207 MEDIUM POC

6.6

CVE-2025-52691 CRITICAL POC

10.0

CVE-2024-50623 CRITICAL POC

9.8

CVE-2017-11357 CRITICAL POC

9.8

CVE-2018-9206 CRITICAL POC

9.8

CVE-2024-5084 CRITICAL POC

9.8

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back