Published: 19/09/2017 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 446

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache tomcat 7.0.2
apache tomcat 7.0.49
apache tomcat 7.0.12
apache tomcat 7.0.62
apache tomcat 7.0.20
apache tomcat 7.0.34
apache tomcat 7.0.58
apache tomcat 7.0.8
apache tomcat 7.0.55
apache tomcat 7.0.1
apache tomcat 7.0.5
apache tomcat 7.0.51
apache tomcat 7.0.4
apache tomcat 7.0.63
apache tomcat 7.0.22
apache tomcat 7.0.39
apache tomcat 7.0.26
apache tomcat 7.0.46
apache tomcat 7.0.72
apache tomcat 7.0.76
apache tomcat 7.0.71
apache tomcat 7.0.28
apache tomcat 7.0.59
apache tomcat 7.0.65
apache tomcat 7.0.0
apache tomcat 7.0.50
apache tomcat 7.0.6
apache tomcat 7.0.18
apache tomcat 7.0.14
apache tomcat 7.0.48
apache tomcat 7.0.11
apache tomcat 7.0.67
apache tomcat 7.0.74
apache tomcat 7.0.23
apache tomcat 7.0.66
apache tomcat 7.0.44
apache tomcat 7.0.69
apache tomcat 7.0.80
apache tomcat 7.0.7
apache tomcat 7.0.42
apache tomcat 7.0.60
apache tomcat 7.0.37
apache tomcat 7.0.29
apache tomcat 7.0.45
apache tomcat 7.0.68
apache tomcat 7.0.13
apache tomcat 7.0.47
apache tomcat 7.0.41
apache tomcat 7.0.31
apache tomcat 7.0.30
apache tomcat 7.0.15
apache tomcat 7.0.19
apache tomcat 7.0.75
apache tomcat 7.0.16
apache tomcat 7.0.10
apache tomcat 7.0.36
apache tomcat 7.0.25
apache tomcat 7.0.54
apache tomcat 7.0.35
apache tomcat 7.0.61
apache tomcat 7.0.79
apache tomcat 7.0.57
apache tomcat 7.0.43
apache tomcat 7.0.32
apache tomcat 7.0.38
apache tomcat 7.0.21
apache tomcat 7.0.27
apache tomcat 7.0.24
apache tomcat 7.0.17
apache tomcat 7.0.40
apache tomcat 7.0.9
apache tomcat 7.0.3
apache tomcat 7.0.77
apache tomcat 7.0.56
apache tomcat 7.0.64
apache tomcat 7.0.70
apache tomcat 7.0.33
apache tomcat 7.0.73

Synopsis Important: Red Hat JBoss Web Server 310 Service Pack 2 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Web Server 31 for RHEL 6 and Red Hat JBoss Web Server 31 for RHEL 7Red Hat Product Security has rated this update as having a sec ...

Synopsis Important: Red Hat JBoss Web Server 310 Service Pack 2 security update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Web Server 31Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scori ...

Debian Bug report logs - #898935 tomcat8: CVE-2018-8014: The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' Package: src:tomcat8; Maintainer for src:tomcat8 is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccors ...

Several security issues were fixed in Tomcat ...

It has been discovered that tomcat version 7080 and before are vulnerable to information disclosure When using a VirtualDirContext it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request ...

Tomcat PUT方法任意文件写入（CVE-2017-12615）exp

Tomcat_PUT_EXP_V14 Tomcat PUT方法任意文件写入（CVE-2017-12615）图形化漏洞利用工具漏洞介绍 2017年9月19日，Apache Tomcat官方确认并修复了两个高危漏洞，漏洞CVE编号:CVE-2017-12615和CVE-2017-12616,其中远程代码执行漏洞（CVE-2017-12615）影响： Apache Tomcat 700 - 7079（7081修复不完全）当 Tomcat 运行�

Tomcat PUT方法任意文件写入（CVE-2017-12615）exp

Tomcat_PUT_EXP_V14 Tomcat PUT方法任意文件写入（CVE-2017-12615）图形化漏洞利用工具漏洞介绍 2017年9月19日，Apache Tomcat官方确认并修复了两个高危漏洞，漏洞CVE编号:CVE-2017-12615和CVE-2017-12616,其中远程代码执行漏洞（CVE-2017-12615）影响： Apache Tomcat 700 - 7079（7081修复不完全）当 Tomcat 运行�

CWE-200 http://www.securitytracker.com/id/1039393 http://www.securityfocus.com/bid/100897 https://www.synology.com/support/security/Synology_SA_17_54_Tomcat https://access.redhat.com/errata/RHSA-2018:0466 https://access.redhat.com/errata/RHSA-2018:0465 https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us https://usn.ubuntu.com/3665-1/https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html https://security.netapp.com/advisory/ntap-20171018-0001/https://lists.apache.org/thread.html/1df9b4552464caa42047062fe7175da0da06c18ecc8daf99258bbda6%40%3Cannounce.tomcat.apache.org%3E https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E https://access.redhat.com/errata/RHSA-2018:0466 https://usn.ubuntu.com/3665-1/https://nvd.nist.gov

CVE-2017-12616

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect