High · published October 4, 2017
CVSS calls it high at 8.1. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.
⚡ A sneaky HTTP PUT vulnerability lets attackers upload malicious JSP files to your Apache Tomcat server—think of it as giving someone the keys to your virtual file cabinet! 🔥 Imagine a restaurant where a customer can slip a secret recipe into the kitchen without anyone checking it. If the chef blindly uses it, the result could be disastrous! An attacker could gain full control over your server, executing any code contained within the uploaded JSP file. This could lead to unauthorized access, data breaches, and potentially devastating damage to your system's integrity.
Imagine a restaurant where a customer can slip a secret recipe into the kitchen without anyone checking it. If the chef blindly uses it, the result could be disastrous! This vulnerability in Apache Tomcat allows unauthorized file uploads via specially crafted HTTP PUT requests when certain configurations are enabled. It affects versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46, and 7.0.0 to 7.0.81.
An attacker could gain full control over your server, executing any code contained within the uploaded JSP file. This could lead to unauthorized access, data breaches, and potentially devastating damage to your system's integrity. Disable HTTP PUT requests unless absolutely necessary, and if you must have them enabled, ensure proper validation and sanitization of uploaded files. Upgrade your Apache Tomcat to versions 8.5.23 or 9.0.1 or later as soon as possible! You've got this! Follow these steps and you'll fortify your server in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| apache/tomcat | ≥ 7.0.0, < 7.0.82 | 7.0.82 |
| apache/tomcat | ≥ 8.0, < 8.0.47 | 8.0.47 |
| apache/tomcat | ≥ 8.5.0, < 8.5.23 | 8.5.23 |
| apache/tomcat | ≥ 9.0.0, < 9.0.1 | 9.0.1 |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/communications_instant_messaging_server | all versions | — |
| oracle/endeca_information_discovery_integrator | all versions | — |
| oracle/endeca_information_discovery_integrator | all versions | — |
| oracle/enterprise_manager_for_mysql_database | all versions | — |
| oracle/financial_services_analytical_applications_infrastructure | ≥ 7.3.3.0.0, ≤ 7.3.5.3.0 | — |
| oracle/financial_services_analytical_applications_infrastructure | ≥ 8.0.0.0.0, ≤ 8.0.9.0.0 | — |
| oracle/fmw_platform | all versions | — |
| oracle/fmw_platform | all versions | — |
| oracle/health_sciences_empirica_inspections | all versions | — |
| oracle/hospitality_guest_access | all versions | — |
| oracle/hospitality_guest_access | all versions | — |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/management_pack | all versions | — |
| oracle/micros_lucas | all versions | — |
| oracle/micros_retail_xbri_loss_prevention | all versions | — |
| oracle/micros_retail_xbri_loss_prevention | all versions | — |
| oracle/micros_retail_xbri_loss_prevention | all versions | — |
| oracle/micros_retail_xbri_loss_prevention | all versions | — |
| oracle/micros_retail_xbri_loss_prevention | all versions | — |
| oracle/micros_retail_xbri_loss_prevention | all versions | — |
| oracle/mysql_enterprise_monitor | ≤ 3.3.6.3293 | — |
| oracle/mysql_enterprise_monitor | ≥ 3.4.0, ≤ 3.4.4.4226 | — |
| oracle/mysql_enterprise_monitor | ≥ 4.0.0, ≤ 4.0.0.5135 | — |
| oracle/retail_advanced_inventory_planning | all versions | — |
| oracle/retail_advanced_inventory_planning | all versions | — |
| oracle/retail_advanced_inventory_planning | all versions | — |
| oracle/retail_advanced_inventory_planning | all versions | — |
| oracle/retail_back_office | all versions | — |
| oracle/retail_back_office | all versions | — |
| oracle/retail_central_office | all versions | — |
| oracle/retail_central_office | all versions | — |
| oracle/retail_convenience_and_fuel_pos_software | all versions | — |
| oracle/retail_eftlink | all versions | — |
| oracle/retail_eftlink | all versions | — |
| oracle/retail_eftlink | all versions | — |
| oracle/retail_insights | all versions | — |
| oracle/retail_insights | all versions | — |
| oracle/retail_insights | all versions | — |
| oracle/retail_insights | all versions | — |
| oracle/retail_invoice_matching | all versions | — |
| oracle/retail_invoice_matching | all versions | — |
| oracle/retail_invoice_matching | all versions | — |
| oracle/retail_invoice_matching | all versions | — |
| oracle/retail_invoice_matching | all versions | — |
| oracle/retail_invoice_matching | all versions | — |
| oracle/retail_invoice_matching | all versions | — |
| oracle/retail_invoice_matching | all versions | — |
| oracle/retail_order_broker | all versions | — |
| oracle/retail_order_broker | all versions | — |
| oracle/retail_order_broker | all versions | — |
| oracle/retail_order_broker | all versions | — |
| oracle/retail_order_broker | all versions | — |
| oracle/retail_order_management_system | all versions | — |
| oracle/retail_order_management_system | all versions | — |
| oracle/retail_order_management_system | all versions | — |
| oracle/retail_order_management_system | all versions | — |
| oracle/retail_point-of-service | all versions | — |
| oracle/retail_point-of-service | all versions | — |
| oracle/retail_price_management | all versions | — |
| oracle/retail_price_management | all versions | — |
| oracle/retail_price_management | all versions | — |
| oracle/retail_price_management | all versions | — |
| oracle/retail_price_management | all versions | — |
| oracle/retail_price_management | all versions | — |
| oracle/retail_price_management | all versions | — |
| oracle/retail_price_management | all versions | — |
| oracle/retail_returns_management | all versions | — |
| oracle/retail_returns_management | all versions | — |
| oracle/retail_returns_management | all versions | — |
| oracle/retail_returns_management | all versions | — |
| oracle/retail_store_inventory_management | all versions | — |
| oracle/retail_store_inventory_management | all versions | — |
| oracle/retail_store_inventory_management | all versions | — |
| oracle/retail_store_inventory_management | all versions | — |
| oracle/retail_store_inventory_management | all versions | — |
| oracle/retail_store_inventory_management | all versions | — |
| oracle/retail_store_inventory_management | all versions | — |
| oracle/retail_store_inventory_management | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/retail_xstore_point_of_service | all versions | — |
| oracle/transportation_management | all versions | — |
| oracle/transportation_management | all versions | — |
| oracle/transportation_management | all versions | — |
| oracle/transportation_management | all versions | — |
| oracle/transportation_management | all versions | — |
| oracle/transportation_management | all versions | — |
| oracle/transportation_management | all versions | — |
| oracle/tuxedo_system_and_applications_monitor | all versions | — |
| oracle/webcenter_sites | all versions | — |
| oracle/workload_manager | all versions | — |
| debian/debian_linux | all versions | — |
| netapp/active_iq_unified_manager | ≥ 7.3 | — |
| netapp/active_iq_unified_manager | ≥ 9.5 | — |
| netapp/oncommand_balance | all versions | — |
| netapp/oncommand_insight | all versions | — |
| netapp/oncommand_shift | all versions | — |
| netapp/oncommand_workflow_automation | all versions | — |
| netapp/snapcenter | all versions | — |
| netapp/element | all versions | — |
| redhat/fuse | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| redhat/jboss_enterprise_application_platform | all versions | — |
| redhat/jboss_enterprise_web_server | all versions | — |
| redhat/jboss_enterprise_web_server | all versions | — |
| redhat/jboss_enterprise_web_server_text-only_advisories | all versions | — |
| redhat/enterprise_linux_desktop | all versions | — |
| redhat/enterprise_linux_desktop | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus_compute_node | all versions | — |
| redhat/enterprise_linux_eus_compute_node | all versions | — |
| redhat/enterprise_linux_eus_compute_node | all versions | — |
| redhat/enterprise_linux_eus_compute_node | all versions | — |
| redhat/enterprise_linux_for_ibm_z_systems | all versions | — |
| redhat/enterprise_linux_for_ibm_z_systems | all versions | — |
| redhat/enterprise_linux_for_ibm_z_systems_eus | all versions | — |
| redhat/enterprise_linux_for_ibm_z_systems_eus | all versions | — |
| redhat/enterprise_linux_for_ibm_z_systems_eus | all versions | — |
| redhat/enterprise_linux_for_ibm_z_systems_eus | all versions | — |
| redhat/enterprise_linux_for_power_big_endian | all versions | — |
| redhat/enterprise_linux_for_power_big_endian | all versions | — |
| redhat/enterprise_linux_for_power_big_endian_eus | all versions | — |
| redhat/enterprise_linux_for_power_big_endian_eus | all versions | — |
| redhat/enterprise_linux_for_power_big_endian_eus | all versions | — |
| redhat/enterprise_linux_for_power_big_endian_eus | all versions | — |
| redhat/enterprise_linux_for_power_little_endian | all versions | — |
| redhat/enterprise_linux_for_power_little_endian_eus | all versions | — |
| redhat/enterprise_linux_for_power_little_endian_eus | all versions | — |
| redhat/enterprise_linux_for_power_little_endian_eus | all versions | — |
| redhat/enterprise_linux_for_power_little_endian_eus | all versions | — |
| redhat/enterprise_linux_server | all versions | — |
| redhat/enterprise_linux_server | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_workstation | all versions | — |
| redhat/enterprise_linux_workstation | all versions | — |