Jboss Enterprise Web Server vulnerabilities

3 known vulnerabilities in Jboss Enterprise Web Server from Red Hat. 3 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Apache Tomcat Remote Code Execution Exploited

  CVE-2017-12617Oct 4, 2017ApacheEPSS 100%

  When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file

• 8.1 High severity

  Apache Tomcat on Windows Remote Code Execution Exploited

  CVE-2017-12615Sep 19, 2017ApacheEPSS 99.7%

  When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could the

• 9.8 Critical severity

  Apache Tomcat Remote Code Execution Exploited

  CVE-2016-8735Apr 6, 2017ApacheEPSS 90.3%

  Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this list