ZeroDay Findings
Sign inSign up

Findings

CVE-2017-12616

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources serv…

Published Sep 19, 2017 · updated Oct 15, 2026 · apache tomcat

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 19, 2017 · NIST NVD

    Detected

    When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

  2. Oct 15, 2026 · NIST NVD

    Updated

    When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

Affected

  • cpe apache/tomcat7.0.0
  • cpe apache/tomcat7.0.1
  • cpe apache/tomcat7.0.2
  • cpe apache/tomcat7.0.3
  • cpe apache/tomcat7.0.4

Sources

  • CVE.orgVulnerability recordCVE-2017-12616

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2017-12616

    When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

    nvd.nist.gov

References

CVE-2017-12616 · ZeroDay Findings