PT-2017-12601 · Apache+3 · Apache Tomcat+3
Xxlegend
·
Publicado
2017-08-16
·
Atualizado
2026-02-19
·
CVE-2017-12615
CVSS v3.1
8.1
Alta
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Apache Tomcat versions 7.0.0 through 7.0.79
Description
The issue allows an attacker to upload a JSP file to the server via a specially crafted request when HTTP PUTs are enabled, for example, by setting the
readonly initialisation parameter of the Default to false. This JSP file can then be requested, and any code it contains would be executed by the server.Recommendations
For Apache Tomcat versions 7.0.0 through 7.0.79, update to version 7.0.81 to obtain a version that includes the fix for this issue. As a temporary workaround, consider disabling HTTP PUTs by setting the
readonly initialisation parameter of the Default to true until a patch is applied. Restrict access to the server to minimize the risk of exploitation.Exploit
Correção
Unrestricted File Upload
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Tomcat
Centos
Red Hat
Suse