When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was
possible to bypass security constraints and/or view the source code of JSPs
for resources served by the VirtualDirContext using a specially crafted
request.

Notes

Author	Note
mdeslaur	this commit is included in commit list for CVE-2017-12617

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchtomcat7< anyUNKNOWN
ubuntu14.04noarchtomcat7< 7.0.52-1ubuntu0.14UNKNOWN
ubuntu16.04noarchtomcat7< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	tomcat7	< any	UNKNOWN
ubuntu	14.04	noarch	tomcat7	< 7.0.52-1ubuntu0.14	UNKNOWN
ubuntu	16.04	noarch	tomcat7	< any	UNKNOWN

References

launchpad.net/bugs/cve/CVE-2017-12616

lists.apache.org/thread.html/1df9b4552464caa42047062fe7175da0da06c18ecc8daf99258bbda6@%3Cannounce.tomcat.apache.org%3E

nvd.nist.gov/vuln/detail/CVE-2017-12616

security-tracker.debian.org/tracker/CVE-2017-12616

tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.81

ubuntu.com/security/notices/USN-3665-1

www.cve.org/CVERecord?id=CVE-2017-12616

ibm 10

nessus 42

prion 2

debiancve 2

veracode 2

openvas 22

redhatcve 2

osv 7

archlinux 1

checkpoint_advisories 3

suse 4

f5 2

dsquare 2

debian 3

cve 2

github 2

cisa 2

ubuntucve 1

freebsd 1

attackerkb 1

packetstorm 2

tomcat 5

nuclei 2

kaspersky 2

zdt 2

mageia 2

exploitpack 2

seebug 3

cisa_kev 1

amazon 3

ubuntu 1

redhat 12

myhack58 1

fedora 3

fortinet 1

thn 1

symantec 1

threatpost 1

oraclelinux 2

centos 2

atlassian 4

talosblog 1

rosalinux 1

avleonov 1

kitploit 2

photon 1

oracle 4

ibm

Security Bulletin: Multiple security vulnerabilities have been identified in Jazz Reporting Service shipped with Rational Insight (CVE-2017-12615, CVE-2017-12616, CVE-2017-12617)

2018-06-17 05:23:49

Security Bulletin: Security vulnerabilities in Apache Tomcat affect multiple IBM Rational products based on IBM's Jazz technology

2021-04-28 18:35:50

Security Bulletin: Multiple security vulnerabilities have been identified in Jazz Team Server shipped with Jazz Reporting Service (CVE-2017-12615, CVE-2017-12616, CVE-2017-12617)

2018-06-17 05:23:49

nessus

Apache Tomcat 7.0.x < 7.0.81 Multiple Vulnerabilities

2018-11-05 00:00:00

Apache Tomcat 7.0.x < 7.0.81 Multiple Vulnerabilities

2017-09-19 00:00:00

Apache Tomcat 7.0.x < 7.0.81 Multiple Vulnerabilities

2019-05-13 00:00:00

prion

Design/Logic Flaw

2017-09-19 13:29:00

Code injection

2017-10-04 01:29:00

debiancve

CVE-2017-12616

2017-09-19 13:29:00

CVE-2017-12617

2017-10-04 01:29:00

veracode

Information Disclosure

2017-09-20 02:23:33

Remote Code Execution

2019-03-12 02:07:05

openvas

SUSE: Security Advisory (SUSE-SU-2017:3059-1)

2021-04-19 00:00:00

Apache Tomcat 'VirtualDirContext' Information Disclosure Vulnerability - Windows

2017-09-25 00:00:00

Debian: Security Advisory (DLA-1108-1)

2018-02-06 00:00:00

redhatcve

CVE-2017-12616

2019-10-08 03:55:37

CVE-2017-12617

2021-07-03 23:30:26

osv

tomcat7 - security update

2017-09-24 00:00:00

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

2022-05-14 01:10:16

CVE-2017-12616

2017-09-19 13:29:00

archlinux

[ASA-201709-17] tomcat7: information disclosure

2017-09-19 00:00:00

checkpoint_advisories

Apache Tomcat VirtualDirContext Information Disclosure (CVE-2017-12616)

2017-10-02 00:00:00

Apache Tomcat HTTP PUT Remote Code Execution (CVE-2017-12617)

2017-10-08 00:00:00

Apache Tomcat PUT Method Arbitrary File Upload Remote Code Execution (CVE-2017-12615; CVE-2017-12617)

2017-09-24 00:00:00

suse

Security update for tomcat (important)

2017-11-23 21:09:20

Security update for tomcat (important)

2017-11-22 15:08:02

Security update for tomcat (important)

2017-11-24 00:09:51

K24335161 : Apache Tomcat vulnerability CVE-2017-12616

2017-09-28 00:00:00

K53173544 : Apache Tomcat vulnerability CVE-2017-12617

2017-10-05 00:00:00

dsquare

Apache Tomcat VirtualDirContext Class File Handling Remote JSP Source Code Disclosure

2018-03-09 00:00:00

Apache Tomcat for Windows HTTP PUT Method File Upload

2018-02-10 00:00:00

debian

[SECURITY] [DLA 1108-1] tomcat7 security update

2017-09-24 16:53:09

[SECURITY] [DLA 1166-1] tomcat7 security update

2017-11-07 19:01:17

[SECURITY] [DLA 1400-1] tomcat7 security update

2018-06-27 20:56:21

cve

CVE-2017-12616

2017-09-19 13:29:00

CVE-2017-12617

2017-10-04 01:29:00

github

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

2022-05-14 01:10:16

Unrestricted Upload of File with Dangerous Type Apache Tomcat

2022-05-14 01:07:15

cisa

Apache Releases Security Updates for Apache Tomcat

2017-10-03 00:00:00

Apache Releases Security Updates for Apache Tomcat

2017-09-19 00:00:00

ubuntucve

CVE-2017-12617

2017-10-03 00:00:00

freebsd

tomcat -- Remote Code Execution

2017-10-04 00:00:00

attackerkb

CVE-2017-12617

2017-10-04 00:00:00

packetstorm

Apache Tomcat Upload Bypass / Remote Code Execution

2017-10-10 00:00:00

Tomcat JSP Upload Bypass Remote Code Execution

2017-10-12 00:00:00

tomcat

Fixed in Apache Tomcat 9.0.1

2017-09-30 00:00:00

Fixed in Apache Tomcat 8.0.47

2017-10-04 00:00:00

Fixed in Apache Tomcat 7.0.82

2017-10-04 00:00:00

nuclei

Apache Tomcat - Remote Code Execution

2023-06-15 08:45:00

Apache Tomcat - Remote Code Execution

2023-06-15 08:45:00

kaspersky

KLA11118 ACE vulnerability in Apache Tomcat

2017-09-21 00:00:00

KLA11106 Multiple vulnerabilities in Apache Tomcat

2017-09-19 00:00:00

zdt

Apache Tomcat JSP Upload Bypass Remote Code Execution Exploit

2017-10-12 00:00:00

Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - Remote Code Execution Exp

2017-10-09 00:00:00

mageia

Updated tomcat packages fix security vulnerability

2017-11-03 00:47:07

Updated tomcat packages fix security vulnerability

2017-09-21 16:43:32

exploitpack

Apache Tomcat 9.0.1 (Beta) 8.5.23 8.0.47 7.0.8 - JSP Upload Bypass Remote Code Execution (2)

2017-10-09 00:00:00

Apache Tomcat 9.0.1 (Beta) 8.5.23 8.0.47 7.0.8 - JSP Upload Bypass Remote Code Execution (1)

2017-09-20 00:00:00

seebug

Apache Tomcat Upload Bypass / Remote Code Execution(CVE-2017-12617)

2017-10-10 00:00:00

Tomcat code execution vulnerability(CVE-2017-12615)

2017-09-20 00:00:00

Tomcat information disclosure Vulnerability(CVE-2017-12616 )analysis

2017-09-21 00:00:00

cisa_kev

Apache Tomcat Remote Code Execution Vulnerability

2022-03-25 00:00:00

amazon

Important: tomcat8, tomcat80, tomcat7

2017-10-26 16:29:00

Important: tomcat

2023-04-27 18:36:00

Important: tomcat7

2023-04-27 16:19:00

ubuntu

Tomcat vulnerabilities

2018-05-30 00:00:00

redhat

(RHSA-2018:0466) Important: Red Hat JBoss Web Server 3.1.0 Service Pack 2 security update

2018-03-07 15:08:21

(RHSA-2018:0465) Important: Red Hat JBoss Web Server 3.1.0 Service Pack 2 security update

2018-03-07 15:08:16

(RHSA-2018:0269) Important: Red Hat JBoss Enterprise Application Platform 6.4.19 security update

2018-02-05 10:26:12

myhack58

Tomcat remote code execution vulnerability flaws bug research CVE-2017-12615 and patch Bypass-vulnerability warning-the black bar safety net

2017-09-20 00:00:00

fedora

[SECURITY] Fedora 27 Update: tomcat-8.0.47-1.fc27

2017-11-11 13:50:22

[SECURITY] Fedora 26 Update: tomcat-8.0.47-1.fc26

2017-11-10 15:18:40

[SECURITY] Fedora 25 Update: tomcat-8.0.47-1.fc25

2017-11-11 15:47:39

fortinet

Apache Tomcat vulnerabilities

2017-10-24 00:00:00

thn

Apache Tomcat Patches Important Remote Code Execution Flaw

2017-10-05 00:16:00

symantec

SA156: Apache Tomcat Vulnerabilities Apr-Oct 2017

2017-11-07 08:00:00

threatpost

5 Steps to Securing Your Network Perimeter

2021-09-27 20:29:43

oraclelinux

tomcat security update

2017-10-30 00:00:00

tomcat6 security update

2017-10-29 00:00:00

centos

tomcat6 security update

2017-10-30 11:27:14

tomcat security update

2017-10-30 11:36:20

atlassian

Upgrade Tomcat to the version 8.5.29

2017-03-14 13:20:53

Upgrade Tomcat to the version 8.5.29

2017-03-14 13:20:53

Update bundled Apache Tomcat due to security vulnerabilities

2017-04-17 08:48:35

talosblog

DNS Hijacking Abuses Trust In Core Internet Service

2019-04-18 16:08:25

rosalinux

Advisory ROSA-SA-2021-1988

2021-07-02 18:17:52

avleonov

Vulnerability Management at Tinkoff Fintech School

2019-03-04 10:38:31

kitploit

Sn1per v7.0 - Automated Pentest Framework For Offensive Security Experts

2019-05-12 13:09:00

Jok3R - Network And Web Pentest Framework

2019-01-23 12:25:00

photon

Critical Photon OS Security Update - PHSA-2017-0078

2017-10-19 00:00:00

oracle

Oracle Critical Patch Update - April 2018

2018-04-17 00:00:00

Oracle Critical Patch Update - January 2018

2018-01-16 00:00:00

Oracle Critical Patch Update Advisory - April 2019

2019-04-16 00:00:00

Products

Security Intelligence
Non-intrusive assessment
Developers SDK
Windows scanner
Linux scanner
Perimeter control tool
MSSP

Database

Vulnerabilities
Exploits
IOC
Security News
BugBounty
Popular
Wild Exploited
Top Vulnerabilities

Tools

Linux Security Scanner
API integration
Subscriptions
Plugins
Manual Audit

Learn More

Stats
API
Docs
Api-keys
License
Pricing
Glossary
FAQ

Company

Blog
Contacts
About Us
OpenSource
EULA
Brand Guideline
Privacy Policy

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please contact us. Using Vulners services you are accepting Vulners services end-user license agreement

@2024 Vulners Inc

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.926 High

EPSS

Percentile

99.0%

JSON

Related for UB:CVE-2017-12616