CVE-2017-12616
HighExposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Published May 14, 2022 · Updated Oct 15, 2026 · Also known as DEBIAN-CVE-2017-12616, DEBIAN-CVE-2017-7674, DEBIAN-CVE-2018-8014, DLA-1108-1, DLA-1400-1, GHSA-8qq4-8jvq-mfw4, UBUNTU-CVE-2017-12616, USN-3665-1
Key Facts
Patch immediately- CVE-2017-12616 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Tomcat (Apache), tomcat7 (debian), tomcat8 (ubuntu) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 70% probability of exploitation in the next 30 days.
- Fixed versions are available, including mod_cluster 0:1.3.8-2.Final_redhat_2.1.ep7.el6, mod_cluster 0:1.3.8-2.Final_redhat_2.1.ep7.el7, org.apache.tomcat:tomcat-catalina 7.0.81.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS (30-day exploit likelihood)
70%
Higher than 99.3% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2017-12616 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.
Affected Products
130 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| TomcatApache | 7.0.0, 7.0.0-beta, 7.0.1, 7.0.10, 7.0.11, 7.0.12, 7.0.13, 7.0.14 | 7.0.76-10.amzn2.0.3 |
| tomcat7debian | See advisory | 7.0.28-4+deb7u15 |
| tomcat8ubuntu | See advisory | 8.0.32-1ubuntu1.6 |
| org.apache.tomcat:tomcat-catalinamaven | >= 7.0.0 | 7.0.81 |
| tomcat7-admin-webappsamazon | See advisory | 7.0.109-1.42.amzn1 |
Patched Releases
mod_cluster
0:1.3.8-2.Final_redhat_2.1.ep7.el6, 0:1.3.8-2.Final_redhat_2.1.ep7.el7
org.apache.tomcat:tomcat-catalina
7.0.81
Tomcat
7.0.76-10.amzn2.0.3, 7.0.82-7.16.1
tomcat-admin-webapps
7.0.76-10.amzn2.0.3, 7.0.82-7.16.1
tomcat-docs-webapp
7.0.76-10.amzn2.0.3, 7.0.82-7.16.1
tomcat-el-2_2-api
7.0.82-7.16.1
tomcat-el-2.2-api
7.0.76-10.amzn2.0.3
tomcat-javadoc
7.0.76-10.amzn2.0.3, 7.0.82-7.16.1
tomcat-jsp-2_2-api
7.0.82-7.16.1
tomcat-jsp-2.2-api
7.0.76-10.amzn2.0.3
tomcat-jsvc
7.0.76-10.amzn2.0.3
tomcat-lib
7.0.76-10.amzn2.0.3, 7.0.82-7.16.1
tomcat-native
0:1.2.8-11.redhat_11.ep7.el6, 0:1.2.8-11.redhat_11.ep7.el7
tomcat-servlet-3_0-api
7.0.82-7.16.1
tomcat-servlet-3.0-api
7.0.76-10.amzn2.0.3
tomcat-vault
0:1.1.6-1.Final_redhat_1.1.ep7.el6, 0:1.1.6-1.Final_redhat_1.1.ep7.el7
tomcat-webapps
7.0.76-10.amzn2.0.3, 7.0.82-7.16.1
tomcat7
0:7.0.70-25.ep7.el6, 0:7.0.70-25.ep7.el7, 7.0.109-1.42.amzn1, 7.0.28-4+deb7u15, 7.0.52-1ubuntu0.14, 7.0.56-3+really7.0.88-1, 7.0.68-1ubuntu0.4+esm3
tomcat7-admin-webapps
7.0.109-1.42.amzn1
tomcat7-docs-webapp
7.0.109-1.42.amzn1
tomcat7-el-2.2-api
7.0.109-1.42.amzn1
tomcat7-javadoc
7.0.109-1.42.amzn1
tomcat7-jsp-2.2-api
7.0.109-1.42.amzn1
tomcat7-lib
7.0.109-1.42.amzn1
tomcat7-log4j
7.0.109-1.42.amzn1
Timeline
Publicly disclosed
May 14, 2022
Last updated
Oct 15, 2026
Weakness Type
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
- advisoryhttps://bugzilla.suse.com/1042910
- advisoryhttps://bugzilla.suse.com/1053352
- advisoryhttps://bugzilla.suse.com/1059551
- advisoryhttps://bugzilla.suse.com/1059554
- advisoryhttps://bugzilla.suse.com/977410
FAQ
Common Questions.
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.
Affected: Tomcat (Apache) versions 7.0.0, 7.0.0-beta, 7.0.1, 7.0.10, 7.0.11, 7.0.12, 7.0.13, 7.0.14; tomcat7 (debian); tomcat8 (ubuntu), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including mod_cluster 0:1.3.8-2.Final_redhat_2.1.ep7.el6, mod_cluster 0:1.3.8-2.Final_redhat_2.1.ep7.el7, org.apache.tomcat:tomcat-catalina 7.0.81.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2017-12616 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo