PoC Index 85,079 CVEs with PoCs

CVE-2017-12615

KEV RANSOMWAREHIGH 8.1EPSS 99.6%

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Affected: Apache Software Foundation · Apache Tomcat
CVSS v3.1 NVD: 8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3.0 GitHub: 8.1 HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
CVSS v2.0 NVD: 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS: 99.64% chance of exploitation in the next 30 days, 100th percentile
CISA KEV: added 2022-03-25, used in ransomware campaigns
Nuclei: high · CWE-434
Published: 2017-09-19
Updated: 2026-08-06

Proof-of-concept exploits (18)

breaktoprotect/CVE-2017-12615112★ · 2022-10-09
1337g/CVE-2017-126154★ · 2017-12-26
BeyondCy/CVE-2017-126151★ · 2017-10-18
Seif-Naouali/Secu_Dev_21★ · 2020-01-20
ZapcoMan/TomcatVulnToolkit10★ · 2025-11-02
cved-sources/cve-2017-126150★ · 2021-04-15
cyberharsh/Tomcat-CVE-2017-126150★ · 2020-06-25
edyekomu/CVE-2017-12615-PoC0★ · 2025-07-17
ianxtianxt/CVE-2017-126151★ · 2020-01-20
mefulton/cve-2017-1261511★ · 2017-10-01
qiantu88/Tomcat-Exploit1★ · 2018-12-19
w0x68y/CVE-2017-12615-EXP1★ · 2021-01-13
wsg00d/cve-2017-126153★ · 2017-11-01
wudidwo/CVE-2017-12615-poc0★ · 2024-11-19
xiaokp7/Tomcat_PUT_GUI_EXP11★ · 2023-03-14
zi0Black/POC-CVE-2017-12615-or-CVE-2017-127176★ · 2017-10-10
xunjinghan/bounty-forge3★ · 2026-10-16
xunwmw/vuln-xiuxian3★ · 2026-10-16

Nuclei templates (1)

projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12615.yaml

ExploitDB entries (1)

https://www.exploit-db.com/exploits/42953

Vulhub environments (1)

vulhub/vulhub/tree/master/tomcat/CVE-2017-12615

Exploit collections (2)

tomcat-cve-2017-12615-rce.ymlchaitin/xray
CVE-2017-12615.yamlzan8in/afrog

Security advisories

References

Related