CVE-2017-12615: Apache Tomcat HTTP PUT JSP File Upload Vulnerability
Summary
CVE-2017-12615: When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Affects org.apache.tomcat.embed:tomcat-embed-core versions >= 7.0.0, < 7.0.79. Fixed in 7.0.79. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. The tomcat-embed-core package is a Maven package that allows embedding Apache Tomcat in other applications. This vulnerability affects versions 7.0.0 to 7.0.79 of the tomcat-embed-core package on Windows systems with HTTP PUTs enabled.
Vulnerability Detail
The vulnerability allows an attacker to upload a malicious JSP file to the server by exploiting the HTTP PUT method. By sending a specially crafted request, an attacker can bypass the server's security measures and upload a JSP file containing arbitrary code. When the uploaded JSP file is requested, the server executes the code within it, leading to remote code execution. This can result in unauthorized access, data leakage, and potential compromise of the server.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.79
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable HTTP PUTs by setting the readonly initialization parameter of the Default to true in the Tomcat configuration. This can be done by modifying the web.xml file or using the Tomcat Manager application. Here is an example of how to disable HTTP PUTs in the web.xml file:
<init-param>
<param-name>readonly</param-name>
<param-value>true</param-value>
</init-param>
Conclusion
The Apache Tomcat HTTP PUT JSP File Upload vulnerability (CVE-2017-12615) allows an attacker to upload and execute arbitrary code on the server. It is crucial to upgrade to a fixed version of the tomcat-embed-core package and properly restrict or disable HTTP PUTs to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat.embed:tomcat-embed-core →
FAQ
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications.
The tomcat-embed-core package is a Maven package that allows embedding Apache Tomcat in other applications.
This vulnerability allows an attacker to upload a malicious JSP file to the server and execute arbitrary code, potentially leading to unauthorized access, data leakage, and compromise of the server.
To fix this vulnerability, upgrade to a fixed version of the tomcat-embed-core package (7.0.79 or later) and ensure that HTTP PUTs are properly restricted or disabled.
Yes, you can temporarily disable HTTP PUTs by setting the readonly initialization parameter of the Default to true in the Tomcat configuration.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat.embed:tomcat-embed-core.
