Lucene search

K
osvGoogleOSV:GHSA-PJFR-QF3P-3Q25
HistoryOct 17, 2018 - 4:30 p.m.

When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server

2018-10-1716:30:31
Google
osv.dev
128

EPSS

0.972

Percentile

99.8%

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

References