CVE-2017-12615
19.09.2017, 13:29
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.Enginsight
| Vendor | Product | Version |
|---|---|---|
| apache | tomcat | 7.0.0 ≤ 𝑥 ≤ 7.0.79 |
| netapp | 7-mode_transition_tool | - |
| netapp | oncommand_balance | - |
| netapp | oncommand_shift | - |
| redhat | enterprise_linux_server_update_services_for_sap_solutions | 7.4 |
| redhat | enterprise_linux_server_update_services_for_sap_solutions | 7.6 |
| redhat | enterprise_linux_server_update_services_for_sap_solutions | 7.7 |
| redhat | jboss_enterprise_web_server | 2.0.0 |
| redhat | jboss_enterprise_web_server | 3.0.0 |
| redhat | jboss_enterprise_web_server_text-only_advisories | - |
| redhat | enterprise_linux_desktop | 6.0 |
| redhat | enterprise_linux_desktop | 7.0 |
| redhat | enterprise_linux_eus | 7.4 |
| redhat | enterprise_linux_eus | 7.5 |
| redhat | enterprise_linux_eus | 7.6 |
| redhat | enterprise_linux_eus | 7.7 |
| redhat | enterprise_linux_eus_compute_node | 7.4 |
| redhat | enterprise_linux_eus_compute_node | 7.5 |
| redhat | enterprise_linux_eus_compute_node | 7.6 |
| redhat | enterprise_linux_eus_compute_node | 7.7 |
| redhat | enterprise_linux_for_ibm_z_systems | 7.0_s390x:_s390x |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 7.4_s390x:_s390x |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 7.5_s390x:_s390x |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 7.6_s390x:_s390x |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 7.7_s390x:_s390x |
| redhat | enterprise_linux_for_power_big_endian | 7.0_ppc64:_ppc64 |
| redhat | enterprise_linux_for_power_big_endian_eus | 7.4_ppc64:_ppc64 |
| redhat | enterprise_linux_for_power_big_endian_eus | 7.5_ppc64:_ppc64 |
| redhat | enterprise_linux_for_power_big_endian_eus | 7.6_ppc64:_ppc64 |
| redhat | enterprise_linux_for_power_big_endian_eus | 7.7_ppc64:_ppc64 |
| redhat | enterprise_linux_for_power_little_endian | 7.0_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_power_little_endian_eus | 7.4_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_power_little_endian_eus | 7.5_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_power_little_endian_eus | 7.6_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_power_little_endian_eus | 7.7_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_scientific_computing | 7.0 |
| redhat | enterprise_linux_server | 6.0 |
| redhat | enterprise_linux_server | 7.0 |
| redhat | enterprise_linux_server_aus | 7.4 |
| redhat | enterprise_linux_server_aus | 7.6 |
| redhat | enterprise_linux_server_aus | 7.7 |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 7.4_ppc64le:_ppc64le |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 7.6_ppc64le:_ppc64le |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 7.7_ppc64le:_ppc64le |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 9.2_ppc64le:_ppc64le |
| redhat | enterprise_linux_server_tus | 7.4 |
| redhat | enterprise_linux_server_tus | 7.6 |
| redhat | enterprise_linux_server_tus | 7.7 |
| redhat | enterprise_linux_workstation | 6.0 |
| redhat | enterprise_linux_workstation | 7.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References