CVE-2017-12617VulnerabilityPublished 03/25/2022Updated 10/24/2026

CVE-2017-12617: Apache Tomcat Remote Code Execution Vulnerability

Affects Apache TomcatSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/25/2022
KEV deadline: 04/15/2022
EPSS: 100.0% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2017-12617 (opens in a new tab)

Description

CVE-2017-12617 is a high severity remote code execution vulnerability in Apache Tomcat. It allows an attacker to upload a JSP file via a specially crafted request, which can then be executed on the server. This vulnerability has been exploited in the wild.

Summary

Apache Tomcat versions are vulnerable to a remote code execution flaw where an attacker can upload a JSP file through a crafted request. Once uploaded, the JSP file can be accessed and executed by the server, allowing arbitrary code execution. This vulnerability is tracked as CVE-2017-12617 and is associated with CWE-434 (Unrestricted Upload of File with Dangerous Type).

Impact

Successful exploitation allows remote attackers to execute arbitrary code on the affected Apache Tomcat server, potentially leading to full system compromise. This vulnerability has been observed in active exploitation in the wild, increasing the risk to affected systems.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is confirmed, restrict file upload permissions and validate uploaded content to prevent JSP file uploads. Monitor for suspicious requests attempting to upload JSP files.

Weaknesses

CWE-434Unrestricted File Upload (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:56:54 UTC

Weaknesses

References

Related threats