CVE-2017-12616

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-12616
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-12616.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2017-12616
Aliases
Downstream
Related
Published
2017-09-19T13:29:00.487Z
Modified
2026-05-14T03:52:01.325685279Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "CPE_FIELD",
            "cpe": "cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*",
            "extracted_events": [
                {
                    "last_affected": "7.0.0-beta"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "cpe": "cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*",
            "extracted_events": [
                {
                    "last_affected": "7.0.2-beta"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "cpe": "cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*",
            "extracted_events": [
                {
                    "last_affected": "7.0.4-beta"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "cpe": "cpe:2.3:a:apache:tomcat:7.0.5:beta:*:*:*:*:*:*",
            "extracted_events": [
                {
                    "last_affected": "7.0.5-beta"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e498667bd7811e846771a852b16ce9f1e524b81b
Last affected
72a8a7c601a7bff56723650d5bb1e353d095af3d
Last affected
511d6f15e4254f3af12c75e5199b66448342eabf
Last affected
6ba80e64fca2badb0a0630f36969365a32a50808
Last affected
53728ececd4dc0134c2e17de849db53ce08219c9
Last affected
bc8b8705a9713cbd0232ab2d326d96ceb4aef1ad
Last affected
4a39288c6eab999452c72af9fd1a0c12b054ca9f
Last affected
6ebe68b8319cbd8c4fa9b629f38b10c09ca38b61
Last affected
04d13f45b4268945a0bee7a56fc4cf3782db0c71
Last affected
7b9e8b1024e03903deca4b4cdd52f368463c723b
Last affected
8b83cefaf2a454706f03f509944ca46103db4d13
Last affected
85cfeb746b8ea0d0e51cc4ced6053075f5460a36
Last affected
de47b464201769870a06764cdd5143a59cd95302
Last affected
0002c728a93f7866b8e3ecf00d5a008327acdc66
Last affected
c845090723d1118dbce1928f9468e1726b79c3b1
Last affected
ec8e60ab88259d3d51c8651a8f72a7a6b1347885
Last affected
9e0d31f12dbd5441097dbec493895ad4e07a6832
Last affected
08611c1dab45979e3e68c25b898f9dcb82888da1
Last affected
4d09baa427e4f70a3198eb06bae39d3b81d52290
Last affected
892c777b9d5c051dc20aacfefc280ab02dbe2143
Last affected
eae5ead3864c4e2d528a874069828c6c12dee8a5
Last affected
ddd8de1c64ef852caca10ab876fed02cfe827ef1
Last affected
6e2c7f6227de95874c79f77bafe5ed26dfeb4021
Last affected
9f62bc56a0887353e58579153a30c64c5369efdb
Last affected
f397fe02d89f7a10a7dc6f38f36b61bad04dfdc7
Last affected
009cf0448025b6227b026e66f5351f0dcb3dd733
Last affected
68e114cf9fe0a83a888099c084b3036040afa518
Last affected
efa0e79f82f17880c0d7427918bc34a83243dfa6
Last affected
5e096bfd5a387f057766dc6b5217feae75b08331
Last affected
b7b373b84f1b80602ed62fb056be7c7ce429a15c
Last affected
86ecd2ad87b805992b9e4c2f2317feaab7a1e3fb
Last affected
247f896633a8a84e2e389d055980fb90cfebffa1
Last affected
7cfeba335a41dd3b0e423f12534e5936c461711c
Last affected
ba53773f48f31de787edb559db38e3e02d7efffd
Last affected
7e8629b4ff4152ae6285fa184745e9a1382ca440
Last affected
fec4a6d1d1f050401aec5c6a3bd0431850472d92
Last affected
37f91884c4cdaee56669c5ffa51b547847b1aa4e
Last affected
3477614af783b612341fa6bc00c16b32d1791de8
Last affected
ddf8c1d016b2fe81f923ed3d9628ba63ce4502a5
Last affected
5f6f258107e7e463cce41187e13474f3c894693e
Last affected
2b858c0fce0db18ca733b161d7428f2cca214841
Last affected
1958059057715d26415839cabad78e685d4d02f1
Last affected
ad3da1182b0ed370ec233b925c69dcee826a9efe
Last affected
506ab576d6e086286b79ca7ddebe679223ec3f9f
Last affected
00ad08058c70b08a9c18555e793d3b6da76d10aa
Last affected
7f5cc05a61f85b195032fb1edef692fca2512d26
Last affected
dcd9daab64a7b557b989a1e0001ffaae0254c8bc
Last affected
81d3e54a46de226a5a8f11bcc65195cddcc24f96
Last affected
bb7683de19c1e441f7f9b986ae5a64a44977b27b
Last affected
66a6ce81eaf86fdaeb2e218f985f3de50da53ac0
Last affected
d70fcee0390d1a82b108979d26a7a397a7418bc7
Last affected
810f549234921d7f3af43c1604f523eec27eeacb
Last affected
b7d6e626d03f61ccd6c92e8ea28df12e67d256e6
Last affected
47af1012111595546f31d9096a37a839f93caa62
Last affected
feaf3763fb37e4a9176ef46a2c80e34821077884
Last affected
30a7e7f7b48aa5f9f4a559635966d70901b5f51d
Last affected
d0c85cd043679c7330066306600b32aa03c22ca3
Last affected
be7e6137267298d6a7b1b3cd2cb1f3f605f9162b
Last affected
ab66216975257e473e5bf4e9a7a59254c905c880
Last affected
8d84136656655a20287cf2dac6ec7fd047979de5
Last affected
20bd21830dfe7864cac78acb1b7c825baa11bd85
Last affected
6b77b128188a5ed033da2998ff2f47f65aa4f7f8
Last affected
f6de6eb5445d266506fcf89d3962a622478c2c6c
Last affected
a6d2ed3eef40903b661d138ae7c8fbd9790d1928
Last affected
7a9d8339c97790213f81b43d91606f38be743617
Last affected
05e76dc1b6edcc2fa87d95de72a8a714267e462d
Last affected
e0ffdd2535a8cb102c62b5db41170625e9d1bf46
Last affected
0b2140180148548e012498e2d7c074fb9d208beb
Last affected
ff181ab22b2b18e77ab9e0f0c2cfe5cfa59c844c
Last affected
c1c4a30d1cc369b918ee86c34ee09ff62c7c6ca6
Last affected
22a6f7d8e615b6cfca151b70e8893c9324e17cc5
Last affected
fe0424f91a9f0af2f6422fe83bfaa769d92aa131
Last affected
fc5bebc0cc58fcd75f3d5178be49a3abe5ae615f
Last affected
12bb2050e3694a795f19395d320f406368f09367
Last affected
73268e886373568fb0c2a150dbbcaf088a2443fb
Last affected
f136158384862c99e7c37937b26bf299fd192a98
Last affected
cbf7381f46f2d8d902562c3cc3147d6d1414d6cb
Last affected
b44e3136d48b3debdd04b828e4b0e4fb96cc1f5e
Database specific 
{
    "source": "CPE_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0.0"
        },
        {
            "last_affected": "7.0.1"
        },
        {
            "last_affected": "7.0.2"
        },
        {
            "last_affected": "7.0.3"
        },
        {
            "last_affected": "7.0.4"
        },
        {
            "last_affected": "7.0.5"
        },
        {
            "last_affected": "7.0.6"
        },
        {
            "last_affected": "7.0.7"
        },
        {
            "last_affected": "7.0.8"
        },
        {
            "last_affected": "7.0.9"
        },
        {
            "last_affected": "7.0.10"
        },
        {
            "last_affected": "7.0.11"
        },
        {
            "last_affected": "7.0.12"
        },
        {
            "last_affected": "7.0.13"
        },
        {
            "last_affected": "7.0.14"
        },
        {
            "last_affected": "7.0.15"
        },
        {
            "last_affected": "7.0.16"
        },
        {
            "last_affected": "7.0.17"
        },
        {
            "last_affected": "7.0.18"
        },
        {
            "last_affected": "7.0.19"
        },
        {
            "last_affected": "7.0.20"
        },
        {
            "last_affected": "7.0.21"
        },
        {
            "last_affected": "7.0.22"
        },
        {
            "last_affected": "7.0.23"
        },
        {
            "last_affected": "7.0.24"
        },
        {
            "last_affected": "7.0.25"
        },
        {
            "last_affected": "7.0.26"
        },
        {
            "last_affected": "7.0.27"
        },
        {
            "last_affected": "7.0.28"
        },
        {
            "last_affected": "7.0.29"
        },
        {
            "last_affected": "7.0.30"
        },
        {
            "last_affected": "7.0.31"
        },
        {
            "last_affected": "7.0.32"
        },
        {
            "last_affected": "7.0.33"
        },
        {
            "last_affected": "7.0.34"
        },
        {
            "last_affected": "7.0.35"
        },
        {
            "last_affected": "7.0.36"
        },
        {
            "last_affected": "7.0.37"
        },
        {
            "last_affected": "7.0.38"
        },
        {
            "last_affected": "7.0.39"
        },
        {
            "last_affected": "7.0.40"
        },
        {
            "last_affected": "7.0.41"
        },
        {
            "last_affected": "7.0.42"
        },
        {
            "last_affected": "7.0.43"
        },
        {
            "last_affected": "7.0.44"
        },
        {
            "last_affected": "7.0.45"
        },
        {
            "last_affected": "7.0.46"
        },
        {
            "last_affected": "7.0.47"
        },
        {
            "last_affected": "7.0.48"
        },
        {
            "last_affected": "7.0.49"
        },
        {
            "last_affected": "7.0.50"
        },
        {
            "last_affected": "7.0.51"
        },
        {
            "last_affected": "7.0.54"
        },
        {
            "last_affected": "7.0.55"
        },
        {
            "last_affected": "7.0.56"
        },
        {
            "last_affected": "7.0.57"
        },
        {
            "last_affected": "7.0.58"
        },
        {
            "last_affected": "7.0.59"
        },
        {
            "last_affected": "7.0.60"
        },
        {
            "last_affected": "7.0.61"
        },
        {
            "last_affected": "7.0.62"
        },
        {
            "last_affected": "7.0.63"
        },
        {
            "last_affected": "7.0.64"
        },
        {
            "last_affected": "7.0.65"
        },
        {
            "last_affected": "7.0.66"
        },
        {
            "last_affected": "7.0.67"
        },
        {
            "last_affected": "7.0.68"
        },
        {
            "last_affected": "7.0.69"
        },
        {
            "last_affected": "7.0.70"
        },
        {
            "last_affected": "7.0.71"
        },
        {
            "last_affected": "7.0.72"
        },
        {
            "last_affected": "7.0.73"
        },
        {
            "last_affected": "7.0.74"
        },
        {
            "last_affected": "7.0.75"
        },
        {
            "last_affected": "7.0.76"
        },
        {
            "last_affected": "7.0.77"
        },
        {
            "last_affected": "7.0.79"
        },
        {
            "last_affected": "7.0.80"
        }
    ],
    "cpe": [
        "cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.51:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.54:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.55:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.56:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.57:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.58:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.59:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.60:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.61:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.62:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.63:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.64:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.65:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.66:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.67:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.68:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.69:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.70:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.71:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.72:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.73:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.74:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.75:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.76:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.77:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.79:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:7.0.80:*:*:*:*:*:*:*"
    ]
}

Affected versions

7.*
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.19
7.0.2
7.0.20
7.0.21
7.0.22
7.0.23
7.0.24
7.0.25
7.0.26
7.0.27
7.0.28
7.0.29
7.0.3
7.0.30
7.0.31
7.0.32
7.0.33
7.0.34
7.0.35
7.0.36
7.0.37
7.0.38
7.0.39
7.0.4
7.0.40
7.0.41
7.0.42
7.0.43
7.0.44
7.0.45
7.0.46
7.0.47
7.0.48
7.0.49
7.0.5
7.0.50
7.0.51
7.0.54
7.0.55
7.0.56
7.0.57
7.0.58
7.0.59
7.0.6
7.0.60
7.0.61
7.0.62
7.0.63
7.0.64
7.0.65
7.0.66
7.0.67
7.0.68
7.0.69
7.0.7
7.0.70
7.0.71
7.0.72
7.0.73
7.0.74
7.0.75
7.0.76
7.0.77
7.0.79
7.0.8
7.0.80
7.0.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-12616.json"