CVE-2017-12616
- Source
- https://cve.org/CVERecord?id=CVE-2017-12616
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12616.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2017-12616
- Aliases
- Downstream
CLSA (1)
DLA (2)
MGASA (1)
RHSA (1)
SUSE (1)
- Related
- Published
- 2017-09-19T13:29:00Z
- Modified
- 2026-10-20T10:48:02Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*", "cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*", "cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*", "cpe:2.3:a:apache:tomcat:7.0.5:beta:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "7.0.0-beta" }, { "last_affected": "7.0.0-beta" }, { "introduced": "7.0.2-beta" }, { "last_affected": "7.0.2-beta" }, { "introduced": "7.0.4-beta" }, { "last_affected": "7.0.4-beta" }, { "introduced": "7.0.5-beta" }, { "last_affected": "7.0.5-beta" } ], "source": "CPE_STRING" } ], "vendor_product": "apache:tomcat" } ] }- References
-
- https://lists.apache.org/thread.html/1df9b4552464caa42047062fe7175da0da06c18ecc8daf99258bbda6%40%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us
- https://usn.ubuntu.com/3665-1/
- https://www.synology.com/support/security/Synology_SA_17_54_Tomcat
- http://www.securityfocus.com/bid/100897
- http://www.securitytracker.com/id/1039393
- https://access.redhat.com/errata/RHSA-2018:0465
- https://access.redhat.com/errata/RHSA-2018:0466
- https://security.netapp.com/advisory/ntap-20171018-0001/
Affected packages
Git / github.com/apache/tomcat
Affected ranges
- Type
- GIT
- Repo
- https://github.com/apache/tomcat
- Events
-
IntroducedLast Affected
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.0" }, { "last_affected": "7.0.0" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.1" }, { "last_affected": "7.0.1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.2" }, { "last_affected": "7.0.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.3" }, { "last_affected": "7.0.3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.4" }, { "last_affected": "7.0.4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.5" }, { "last_affected": "7.0.5" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.6" }, { "last_affected": "7.0.6" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.7" }, { "last_affected": "7.0.7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.8" }, { "last_affected": "7.0.8" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.9" }, { "last_affected": "7.0.9" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.10" }, { "last_affected": "7.0.10" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.11" }, { "last_affected": "7.0.11" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.12" }, { "last_affected": "7.0.12" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.13" }, { "last_affected": "7.0.13" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.14" }, { "last_affected": "7.0.14" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.15" }, { "last_affected": "7.0.15" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.16" }, { "last_affected": "7.0.16" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.17" }, { "last_affected": "7.0.17" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.18" }, { "last_affected": "7.0.18" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.19" }, { "last_affected": "7.0.19" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.20" }, { "last_affected": "7.0.20" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.21" }, { "last_affected": "7.0.21" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.22" }, { "last_affected": "7.0.22" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.23" }, { "last_affected": "7.0.23" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.24" }, { "last_affected": "7.0.24" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.25" }, { "last_affected": "7.0.25" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.26" }, { "last_affected": "7.0.26" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.27" }, { "last_affected": "7.0.27" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.28" }, { "last_affected": "7.0.28" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.29" }, { "last_affected": "7.0.29" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.30" }, { "last_affected": "7.0.30" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.31" }, { "last_affected": "7.0.31" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.32" }, { "last_affected": "7.0.32" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.33" }, { "last_affected": "7.0.33" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.34" }, { "last_affected": "7.0.34" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.35" }, { "last_affected": "7.0.35" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.36" }, { "last_affected": "7.0.36" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.37" }, { "last_affected": "7.0.37" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.38" }, { "last_affected": "7.0.38" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.39" }, { "last_affected": "7.0.39" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.40" }, { "last_affected": "7.0.40" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.41" }, { "last_affected": "7.0.41" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.42" }, { "last_affected": "7.0.42" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.43" }, { "last_affected": "7.0.43" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.44" }, { "last_affected": "7.0.44" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.45" }, { "last_affected": "7.0.45" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.46" }, { "last_affected": "7.0.46" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.47" }, { "last_affected": "7.0.47" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.48" }, { "last_affected": "7.0.48" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.49" }, { "last_affected": "7.0.49" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.50" }, { "last_affected": "7.0.50" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.51:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.51" }, { "last_affected": "7.0.51" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.54:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.54" }, { "last_affected": "7.0.54" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.55:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.55" }, { "last_affected": "7.0.55" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.56:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.56" }, { "last_affected": "7.0.56" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.57:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.57" }, { "last_affected": "7.0.57" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.58:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.58" }, { "last_affected": "7.0.58" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.59:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.59" }, { "last_affected": "7.0.59" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.60:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.60" }, { "last_affected": "7.0.60" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.61:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.61" }, { "last_affected": "7.0.61" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.62:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.62" }, { "last_affected": "7.0.62" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.63:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.63" }, { "last_affected": "7.0.63" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.64:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.64" }, { "last_affected": "7.0.64" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.65:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.65" }, { "last_affected": "7.0.65" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.66:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.66" }, { "last_affected": "7.0.66" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.67:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.67" }, { "last_affected": "7.0.67" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.68:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.68" }, { "last_affected": "7.0.68" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.69:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.69" }, { "last_affected": "7.0.69" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.70:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.70" }, { "last_affected": "7.0.70" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.71:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.71" }, { "last_affected": "7.0.71" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.72:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.72" }, { "last_affected": "7.0.72" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.73:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.73" }, { "last_affected": "7.0.73" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.74:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.74" }, { "last_affected": "7.0.74" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.75:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.75" }, { "last_affected": "7.0.75" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.76:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.76" }, { "last_affected": "7.0.76" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.77:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.77" }, { "last_affected": "7.0.77" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.79:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.79" }, { "last_affected": "7.0.79" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:7.0.80:*:*:*:*:*:*:*", "range": [ { "introduced": "7.0.80" }, { "last_affected": "7.0.80" } ], "source": "CPE_STRING" } ] }
Affected versions
7.*
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.51
7.0.54
7.0.55
7.0.56
7.0.57
7.0.58
7.0.59
7.0.6
7.0.60
7.0.61
7.0.62
7.0.63
7.0.64
7.0.65
7.0.66
7.0.67
7.0.68
7.0.69
7.0.7
7.0.70
7.0.71
7.0.72
7.0.73
7.0.74
7.0.75
7.0.76
7.0.77
7.0.79
7.0.8
7.0.80
7.0.9