CVE-2017-12617 in apache tomcat
LogPulse has a published detection rule for this CVE: it raises a notable when someone tries to exploit it.
What the vulnerability is
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Affected software: apache tomcat, canonical ubuntu linux, oracle agile product lifecycle management, oracle communications instant messaging server, oracle endeca information discovery integrator, oracle enterprise manager for mysql database, oracle financial services analytical applications infrastructure, oracle fmw platform, oracle health sciences empirica inspections, oracle hospitality guest access
Scores
- CVSS: 8.1 (high)
- EPSS: 99.97% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2022-03-25
- Published: 2017-10-04
What LogPulse has for it
- Detection rule: Yes, published
- Agent check (vulnerable version): No
- Mitigation: No
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.