The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-2389:05 advisory.

    * A vulnerability was discovered in Tomcat's handling of pipelined requests when Sendfile was used. If     sendfile processing completed quickly, it was possible for the Processor to be added to the processor     cache twice. This could lead to invalid responses or information disclosure. (CVE-2017-5647)
      * Two vulnerabilities were discovered in Tomcat where if a servlet context was configured with     readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and     achieve code execution. (CVE-2017-12615, CVE-2017-12617)
      * A vulnerability was discovered in Tomcat where the CORS Filter did not send a Vary: Origin HTTP     header. This potentially allowed sensitive data to be leaked to other visitors through both client-side     and server-side caches. (CVE-2017-7674)     CVE-2017-12615     When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs     enabled (e.g. via setting the readonly initialisation parameter of the     Default to false) it was possible to upload a JSP file to the server     via a specially crafted request. This JSP could then be requested and     any code it contained would be executed by the server.
    CVE-2017-12617     When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to     8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled     (e.g. via setting the readonly initialisation parameter of the Default     servlet to false) it was possible to upload a JSP file to the server     via a specially crafted request. This JSP could then be requested and     any code it contained would be executed by the server.
    CVE-2017-5647     A bug in the handling of the pipelined requests in Apache Tomcat     9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to     7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the     pipelined request being lost when send file processing of the previous     request completed. This could result in responses appearing to be sent     for the wrong request. For example, a user agent that sent requests A,     B and C could see the correct response for request A, the response for     request C for request B and no response for request C.
    CVE-2017-7674     The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to     8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP     Vary header indicating that the response varies depending on Origin.
    This permitted client and server side cache poisoning in some     circumstances.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 8.0.47. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_8.0.47_security-8 advisory.

  - When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to     7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default     servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This     JSP could then be requested and any code it contained would be executed by the server. (CVE-2017-12617)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The HTTP server running on the remote host is affected by a flaw that allows a remote unauthenticated attacker to upload a JSP file and execute it.

An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and Red Hat JBoss Web Server 3.1 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 3.1 Service Pack 2 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References.

Security Fix(es) :

* apr: Out-of-bounds array deref in apr_time_exp*() functions (CVE-2017-12613)

* tomcat: Remote Code Execution via JSP Upload (CVE-2017-12615)

* tomcat: Information Disclosure when using VirtualDirContext (CVE-2017-12616)

* tomcat: Remote Code Execution bypass for CVE-2017-12615 (CVE-2017-12617)

* tomcat-native: Mishandling of client certificates can allow for OCSP check bypass (CVE-2017-15698)

* tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources (CVE-2018-1304)

* tomcat: Late application of security constraints can lead to resource exposure for unauthorised users (CVE-2018-1305)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3080 advisory.

    - Resolves: rhbz#1498345 CVE-2017-12615 CVE-2017-12617 tomcat6: various flaws
    - Resolves: rhbz#1461292 CVE-2017-5664 tomcat6: tomcat: Security constrained bypass in error page     mechanism

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution. (CVE-2017-12617)

This update includes a rebase from 8.0.46 up to 8.0.47 which resolves a single CVE along with various other bugs/features :

rhbz#1497682 CVE-2017-12617 tomcat: Remote Code Execution bypass for CVE-2017-12615

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
289035	MiracleLinux 7 : tomcat-7.0.76-3.el7 (AXSA:2017-2389:05)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/17	high
103697	Apache Tomcat 8.0.0.RC1 < 8.0.47	Nessus	Web Servers	2017/10/6	2024/5/23	high
105006	Apache Tomcat HTTP PUT JSP File Upload RCE	Nessus	Web Servers	2017/12/4	2023/4/25	high
107208	RHEL 6 / 7 : Red Hat JBoss Web Server 3.1.0 Service Pack 2 (RHSA-2018:0466)	Nessus	Red Hat Local Security Checks	2018/3/8	2023/4/25	high
104247	Oracle Linux 6 : tomcat6 (ELSA-2017-3080)	Nessus	Oracle Linux Local Security Checks	2017/10/30	2024/11/1	high
104179	Amazon Linux AMI : tomcat8 / tomcat80,tomcat7 (ALAS-2017-913)	Nessus	Amazon Linux Local Security Checks	2017/10/27	2025/11/17	high
104505	Fedora 26 : 1:tomcat (2017-ef7c118dbc)	Nessus	Fedora Local Security Checks	2017/11/13	2025/11/14	high

检测

插件搜索

high

high

high

high

high

high

high