Live › vulnerability › CVE-2017-12615
Go to dashboardApache Tomcat on Windows with HTTP PUT enabled accepts a crafted PUT request that uploads a JSP file to the server. Requesting that JSP then runs whatever code it contains on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Apache Tomcat | vendor | – | – |
Confirm the host runs Tomcat on Windows and check conf/web.xml for the default servlet's readonly setting and whether readonly is set to false; a PUT to a test path returning 201 or 204 means exposure.
Upgrade Apache Tomcat to a fixed release listed by Apache for CVE-2017-12615 (the sources do not list exact versions); set readonly to true on the default servlet or disable PUT.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
This page as .md · .json · in your agent: get_signal("CVE-2017-12615")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.