CVE-2017-12617

Apache Tomcat allowed attackers to upload and execute arbitrary JSP files, enabling remote code execution.

An attacker could upload a malicious JSP file via a crafted request, which the server would then execute upon access. This remote code execution vulnerability is actively exploited in the wild and represents a severe compliance failure for any organization running Tomcat without proper patching or access controls. DIB organizations must ensure Tomcat is patched and restricted to prevent attackers from injecting and executing arbitrary code.

Shame score — This is a high-severity, actively exploited vulnerability that allows remote code execution, representing a negligent failure to patch known critical flaws.