CVE-2017-12617

Apache Tomcat-ning 9.0.0.M1 dan 9.0.0 gacha, 8.5.0 dan 8.5.22 gacha, 8.0.0.RC1 dan 8.0.46 gacha va 7.0.0 dan 7.0.81 gacha bo'lgan HTTP PUT-lari yoqilgan versiyalarini ishga tushirganda (masalan, faqat o'qish uchun Defalult-ni yuklash parametrini o'rnatish orqali). JSP faylini serverga maxsus tayyorlangan so'rov orqali yuboring. Keyinchalik bu JSP so'ralishi mumkin va undagi har qanday kod server tomonidan bajariladi.

CVSS Vector

Manbalar

• http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
• http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
• http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
• http://www.securityfocus.com/bid/100954
• http://www.securitytracker.com/id/1039552