Exploited Vulnerabilities DailyCVE-2017-12615: Apache Tomcat
EPSS99.6%No. 175 of 1739 in KEV
CVE year2017~5 yrs before listing
Same vendor in KEV41
Same product6
| Field | Value |
|---|---|
| Vendor | Apache |
| Product | Tomcat |
| Name | Apache Tomcat on Windows Remote Code Execution Vulnerability |
| Added to KEV | 2022-03-25 |
| US federal due date | 2022-04-15 |
| Ransomware use | Known |
| CWE | CWE-434 |
CISA description
When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Other entries for this product
| CVE | Vendor / product | Added | EPSS | Ransomware |
|---|---|---|---|---|
| CVE-2026-34486 | Apache Tomcat | 2026-08-04 | 6.5% | Unknown |
| CVE-2025-24813 | Apache Tomcat | 2025-04-01 | 99.9% | Unknown |
| CVE-2016-8735 | Apache Tomcat | 2023-05-12 | 90.3% | Unknown |
| CVE-2017-12617 | Apache Tomcat | 2022-03-25 | 99.9% | Unknown |
| CVE-2020-1938 | Apache Tomcat | 2022-03-03 | 99.2% | Unknown |
Data from CISA's Known Exploited Vulnerabilities (KEV) catalog. EPSS is FIRST's estimated probability of exploitation activity in the next 30 days, refreshed weekly. Always follow the vendor's official guidance.
About this page
A Apache Tomcat vulnerability added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-25.