tomcat-catalina is vulnerable to remote code execution (RCE) attacks. On a Windows system with HTTP PUTs enabled a malicious user can upload a JSP file to the server which would then be executed.

CPENameOperatorVersion
tomcat6eq6.0.41__17_patch_04.ep6.el6
tomcat6eq6.0.41__6_patch_02.ep6.el7
tomcat6eq6.0.24__24.el6_0
tomcat6eq6.0.32__31_patch_08.ep5.el6
tomcat6eq6.0.24__62.el6
tomcat6eq6.0.24__49.el6
tomcat6eq6.0.37__29_patch_05.ep6.el6
tomcat6eq6.0.24__80.el6
tomcat6eq6.0.24__15.el6
tomcat6eq6.0.24__83.el6_6

Name	Operator	Version
tomcat6	eq	6.0.41__17_patch_04.ep6.el6
tomcat6	eq	6.0.41__6_patch_02.ep6.el7
tomcat6	eq	6.0.24__24.el6_0
tomcat6	eq	6.0.32__31_patch_08.ep5.el6
tomcat6	eq	6.0.24__62.el6
tomcat6	eq	6.0.24__49.el6
tomcat6	eq	6.0.37__29_patch_05.ep6.el6
tomcat6	eq	6.0.24__80.el6
tomcat6	eq	6.0.24__15.el6
tomcat6	eq	6.0.24__83.el6_6

Rows per page:

1-10 of 2081

References

access.redhat.com/errata/RHSA-2017:3080

access.redhat.com/security/updates/classification/#important

bugzilla.redhat.com/show_bug.cgi?id=1461851

osv 2

cve 1

attackerkb 1

canvas 1

prion 1

zdt 1

github 1

f5 1

packetstorm 1

nessus 22

cisa_kev 1

nuclei 1

veracode 1

debiancve 1

redhatcve 2

ubuntucve 1

freebsd 1

openvas 10

fedora 3

seebug 2

tomcat 1

fortinet 1

exploitpack 1

ibm 8

thn 1

cisa 1

checkpoint_advisories 1

myhack58 1

kaspersky 1

exploitdb 1

oraclelinux 2

redhat 7

centos 2

suse 1

symantec 1

atlassian 2

kitploit 1

osv

CVE-2017-12615

2017-09-19 13:29:00

When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server

2018-10-17 16:30:31

cve

CVE-2017-12615

2017-09-19 13:29:00

attackerkb

CVE-2017-12615

2017-09-19 00:00:00

canvas

Immunity Canvas: TOMCAT_FILE_UPLOAD

2017-09-19 13:29:00

prion

Design/Logic Flaw

2017-09-19 13:29:00

zdt

Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass Exploit

2017-10-04 00:00:00

github

When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server

2018-10-17 16:30:31

K85088617 : Apache Tomcat vulnerability CVE-2017-12615

2017-09-25 00:00:00

packetstorm

Apache Tomcat JSP Upload Bypass / Remote Code Execution

2017-10-04 00:00:00

nessus

FreeBSD : payara -- Code execution via crafted PUT requests to JSPs (22bc5327-f33f-11e8-be46-0019dbb15b3f)

2018-11-29 00:00:00

Fedora 26 : 1:tomcat (2017-ef7c118dbc)

2017-11-13 00:00:00

Fedora 25 : 1:tomcat (2017-f499ee7b12)

2017-11-13 00:00:00

cisa_kev

Apache Tomcat on Windows Remote Code Execution Vulnerability

2022-03-25 00:00:00

nuclei

Apache Tomcat Servers - Remote Code Execution

2021-02-10 09:44:26

veracode

Remote Code Execution (RCE)

2017-09-20 04:22:32

debiancve

CVE-2017-12615

2017-09-19 13:29:00

redhatcve

CVE-2017-12615

2019-10-08 12:15:56

CVE-2017-12617

2021-07-03 23:30:26

ubuntucve

CVE-2017-12615

2017-09-19 00:00:00

freebsd

payara -- Code execution via crafted PUT requests to JSPs

2017-08-07 00:00:00

openvas

Apache Tomcat 'HTTP PUT Request' Code Execution Vulnerability - Windows

2017-09-25 00:00:00

Fedora Update for tomcat FEDORA-2017-f499ee7b12

2017-11-23 00:00:00

Fedora Update for tomcat FEDORA-2017-ef7c118dbc

2017-11-23 00:00:00

fedora

[SECURITY] Fedora 27 Update: tomcat-8.0.47-1.fc27

2017-11-11 13:50:22

[SECURITY] Fedora 26 Update: tomcat-8.0.47-1.fc26

2017-11-10 15:18:40

[SECURITY] Fedora 25 Update: tomcat-8.0.47-1.fc25

2017-11-11 15:47:39

seebug

Tomcat code execution vulnerability(CVE-2017-12615)

2017-09-20 00:00:00

Tomcat information disclosure Vulnerability(CVE-2017-12616 )analysis

2017-09-21 00:00:00

tomcat

Fixed in Apache Tomcat 7.0.81

2017-08-16 00:00:00

fortinet

Apache Tomcat vulnerabilities

2017-10-24 00:00:00

exploitpack

Apache Tomcat 9.0.1 (Beta) 8.5.23 8.0.47 7.0.8 - JSP Upload Bypass Remote Code Execution (1)

2017-09-20 00:00:00

ibm

Security Bulletin: WebSphere Message Broker and IBM Integration Bus is affected by Open Source Apache Tomcat Vulnerabilities (CVE-2017-12617,CVE-2017-12615)

2020-03-23 20:41:52

Security Bulletin: Multiple security vulnerabilities have been identified in Jazz Team Server shipped with Jazz Reporting Service (CVE-2017-12615, CVE-2017-12616, CVE-2017-12617)

2018-06-17 05:23:49

Security Bulletin: Multiple security vulnerabilities have been identified in Jazz Reporting Service shipped with Rational Reporting for Development Intelligence (CVE-2017-12615, CVE-2017-12616, CVE-2017-12617)

2018-06-17 05:23:49

thn

Apache Tomcat Patches Important Remote Code Execution Flaw

2017-10-05 00:16:00

cisa

Apache Releases Security Updates for Apache Tomcat

2017-09-19 00:00:00

checkpoint_advisories

Apache Tomcat PUT Method Arbitrary File Upload Remote Code Execution (CVE-2017-12615; CVE-2017-12617)

2017-09-24 00:00:00

myhack58

Tomcat remote code execution vulnerability flaws bug research CVE-2017-12615 and patch Bypass-vulnerability warning-the black bar safety net

2017-09-20 00:00:00

kaspersky

KLA11106 Multiple vulnerabilities in Apache Tomcat

2017-09-19 00:00:00

exploitdb

Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1)

2017-09-20 00:00:00

oraclelinux

tomcat6 security update

2017-10-29 00:00:00

tomcat security update

2017-10-30 00:00:00

redhat

(RHSA-2017:3080) Important: tomcat6 security update

2017-10-29 22:35:53

(RHSA-2017:3081) Important: tomcat security update

2017-10-29 22:36:17

(RHSA-2017:3114) Important: Red Hat JBoss Web Server security and bug fix update

2017-11-02 19:03:45

centos

tomcat security update

2017-10-30 11:36:20

tomcat6 security update

2017-10-30 11:27:14

suse

Security update for tomcat (important)

2017-11-23 21:09:20

symantec

SA156: Apache Tomcat Vulnerabilities Apr-Oct 2017

2017-11-07 08:00:00

atlassian

Update bundled Apache Tomcat due to security vulnerabilities

2017-04-17 08:48:35

Update bundled Apache Tomcat due to security vulnerabilities

2017-04-17 08:48:35

kitploit

Vulmap - Web Vulnerability Scanning And Verification Tools

2020-12-25 11:30:00

Products

Security Intelligence
Non-intrusive assessment
Developers SDK
Windows scanner
Linux scanner
Perimeter control tool
MSSP

Database

Vulnerabilities
Exploits
IOC
Security News
BugBounty
Popular
Wild Exploited
Top Vulnerabilities

Tools

Linux Security Scanner
API integration
Subscriptions
Plugins
Manual Audit

Learn More

Stats
API
Docs
Api-keys
License
Pricing
Glossary
FAQ

Company

Blog
Contacts
About Us
OpenSource
EULA
Brand Guideline
Privacy Policy

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please contact us. Using Vulners services you are accepting Vulners services end-user license agreement

@2024 Vulners Inc

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

JSON

Related for VERACODE:12594