Answer in brief
CVE-2017-12615 records a High severity (CVSS 8.1) vulnerability in CVE Program Container. The current sources mark it as known exploited. The current feed maps Apache Software Foundation/Apache Tomcat (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.1. Known-exploitation status makes exposure review time-sensitive. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Apache Software Foundation/Apache Tomcat (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.4:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.6:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.7:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:redhat:jboss_enterprise_web_server:2.0.0:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:a:redhat:jboss_enterprise_web_server_text-only_advisories:-:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_eus_compute_node:7.4:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_eus_compute_node:7.5:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_eus_compute_node:7.6:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_eus_compute_node:7.7:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.4_s390x:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.5_s390x:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.6_s390x:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:7.7_s390x:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.4_ppc64:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.5_ppc64:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.6_ppc64:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.7_ppc64:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.4_ppc64le:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.5_ppc64le:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.6_ppc64le:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:7.7_ppc64le:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.4_ppc64le:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.6_ppc64le:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.7_ppc64le:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2_ppc64le:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Apache Software Foundation/Apache Tomcatgeneric | 7.0.0 to 7.0.79 | Not reported |
Published upstream
Sep 19, 2017
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
May 24, 2026
Added to CISA KEV
Mar 25, 2022
Evidence: source:kev:kev:kev:recordWhen running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Quoted source text, attributed separately from HOL analysis.