{"id":"CVE-2017-12617","title":"When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g","summary":"When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possib…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-434","CWE-434"],"vendor":"apache","product":"tomcat","affected":["tomcat >= 7.0.0, < 7.0.82","tomcat >= 8.0, < 8.0.47","tomcat >= 8.5.0, < 8.5.23","tomcat >= 9.0.0, < 9.0.1","ubuntu_linux = 12.04","ubuntu_linux = 16.04","ubuntu_linux = 17.10","ubuntu_linux = 18.04","agile_product_lifecycle_management = 9.3.3","agile_product_lifecycle_management = 9.3.4","agile_product_lifecycle_management = 9.3.5","agile_product_lifecycle_management = 9.3.6","communications_instant_messaging_server = 10.0.1","endeca_information_discovery_integrator = 3.1.0","endeca_information_discovery_integrator = 3.2.0","enterprise_manager_for_mysql_database = 12.1.0.4.0","financial_services_analytical_applications_infrastructure >= 7.3.3.0.0, <= 7.3.5.3.0","financial_services_analytical_applications_infrastructure >= 8.0.0.0.0, <= 8.0.9.0.0","fmw_platform = 12.2.1.2.0","fmw_platform = 12.2.1.3.0","health_sciences_empirica_inspections = 1.0.1.1","hospitality_guest_access = 4.2.0","hospitality_guest_access = 4.2.1","instantis_enterprisetrack = 17.1","instantis_enterprisetrack = 17.2","management_pack = 11.2.1.0.13","micros_lucas = 2.9.5","micros_retail_xbri_loss_prevention = 10.0.1","micros_retail_xbri_loss_prevention = 10.5.0","micros_retail_xbri_loss_prevention = 10.6.0","micros_retail_xbri_loss_prevention = 10.7.0","micros_retail_xbri_loss_prevention = 10.8.0","micros_retail_xbri_loss_prevention = 10.8.1","mysql_enterprise_monitor <= 3.3.6.3293","mysql_enterprise_monitor >= 3.4.0, <= 3.4.4.4226","mysql_enterprise_monitor >= 4.0.0, <= 4.0.0.5135","retail_advanced_inventory_planning = 13.2","retail_advanced_inventory_planning = 13.4","retail_advanced_inventory_planning = 14.1","retail_advanced_inventory_planning = 15.0","retail_back_office = 14.0.4","retail_back_office = 14.1.3","retail_central_office = 14.0.4","retail_central_office = 14.1.3","retail_convenience_and_fuel_pos_software = 2.1.132","retail_eftlink = 1.1.124","retail_eftlink = 15.0.1","retail_eftlink = 16.0.2","retail_insights = 14.0","retail_insights = 14.1","retail_insights = 15.0","retail_insights = 16.0","retail_invoice_matching = 12.0","retail_invoice_matching = 13.0","retail_invoice_matching = 13.1","retail_invoice_matching = 13.2","retail_invoice_matching = 14.0","retail_invoice_matching = 14.1","retail_invoice_matching = 15.0","retail_invoice_matching = 16.0","retail_order_broker = 5.0","retail_order_broker = 5.1","retail_order_broker = 5.2","retail_order_broker = 15.0","retail_order_broker = 16.0","retail_order_management_system = 4.0","retail_order_management_system = 4.5","retail_order_management_system = 4.7","retail_order_management_system = 5.0","retail_point-of-service = 14.0.4","retail_point-of-service = 14.1.3","retail_price_management = 12.0","retail_price_management = 13.0","retail_price_management = 13.1","retail_price_management = 13.2","retail_price_management = 14.0","retail_price_management = 14.1","retail_price_management = 15.0","retail_price_management = 16.0","retail_returns_management = 2.3.8","retail_returns_management = 2.4.9","retail_returns_management = 14.0.4","retail_returns_management = 14.1.3","retail_store_inventory_management = 12.0.12","retail_store_inventory_management = 13.0.7","retail_store_inventory_management = 13.1.9","retail_store_inventory_management = 13.2.9","retail_store_inventory_management = 14.0.4","retail_store_inventory_management = 14.1.3","retail_store_inventory_management = 15.0.2","retail_store_inventory_management = 16.0.1","retail_xstore_point_of_service = 6.0.11","retail_xstore_point_of_service = 7.0.6","retail_xstore_point_of_service = 7.1.6","retail_xstore_point_of_service = 15.0.1","transportation_management = 6.3.1","transportation_management = 6.3.2","transportation_management = 6.3.3","transportation_management = 6.3.4","transportation_management = 6.3.5"],"patched":["tomcat 9.0.1"],"published":"2017-10-04","updated":"2026-08-25","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2017-12617","references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","label":"security@apache.org"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","label":"security@apache.org"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","label":"security@apache.org"},{"url":"http://www.securityfocus.com/bid/100954","label":"security@apache.org"},{"url":"http://www.securitytracker.com/id/1039552","label":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2017:3080","label":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2017:3081","label":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2017:3113","label":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2017:3114","label":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:0268","label":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:0269","label":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:0270","label":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:0271","label":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:0275","label":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:0465","label":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:0466","label":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2018:2939","label":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","label":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","label":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","label":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","label":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb%40%3Cannounce.tomcat.apache.org%3E","label":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","label":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","label":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","label":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","label":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","label":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","label":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","label":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","label":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","label":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","label":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","label":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","label":"security@apache.org"},{"url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00009.html","label":"security@apache.org"},{"url":"https://security.netapp.com/advisory/ntap-20171018-0002/","label":"security@apache.org"},{"url":"https://security.netapp.com/advisory/ntap-20180117-0002/","label":"security@apache.org"},{"url":"https://support.f5.com/csp/article/K53173544","label":"security@apache.org"},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03812en_us","label":"security@apache.org"},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","label":"security@apache.org"},{"url":"https://usn.ubuntu.com/3665-1/","label":"security@apache.org"},{"url":"https://www.exploit-db.com/exploits/42966/","label":"security@apache.org"},{"url":"https://www.exploit-db.com/exploits/43008/","label":"security@apache.org"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","label":"security@apache.org"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/100954","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1039552","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:3080","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:3081","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:3113","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:3114","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0268","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0269","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0270","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0271","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0275","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0465","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:0466","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2018:2939","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb%40%3Cannounce.tomcat.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00009.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20171018-0002/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20180117-0002/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.f5.com/csp/article/K53173544","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03812en_us","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3665-1/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/42966/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/43008/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12617","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild","exploit-available"],"epss":0.99988,"epssPercentile":0.99984,"kev":true,"kevDateAdded":"2022-03-25","kevDueDate":"2022-04-15","kevRansomware":false,"exploited":true,"exploitAvailable":true,"ingestedAt":"2026-08-25T17:29:29.067Z","exploits":{"exploitdb":true,"github":10,"githubRepos":["https://github.com/cyberheartmi9/CVE-2017-12617","https://github.com/devcoinfet/CVE-2017-12617","https://github.com/qiantu88/CVE-2017-12617"],"metasploit":["exploit/multi/http/tomcat_jsp_upload_bypass"],"nuclei":["CVE-2017-12617"],"checkedAt":"2026-09-08T15:36:49.085Z"},"slug":"CVE-2017-12617","body":"## Overview\n\nWhen running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.\n\n## Affected\n\n- `tomcat >= 7.0.0, < 7.0.82`\n- `tomcat >= 8.0, < 8.0.47`\n- `tomcat >= 8.5.0, < 8.5.23`\n- `tomcat >= 9.0.0, < 9.0.1`\n- `ubuntu_linux = 12.04`\n- `ubuntu_linux = 16.04`\n- `ubuntu_linux = 17.10`\n- `ubuntu_linux = 18.04`\n- `agile_product_lifecycle_management = 9.3.3`\n- `agile_product_lifecycle_management = 9.3.4`\n- `agile_product_lifecycle_management = 9.3.5`\n- `agile_product_lifecycle_management = 9.3.6`\n- `communications_instant_messaging_server = 10.0.1`\n- `endeca_information_discovery_integrator = 3.1.0`\n- `endeca_information_discovery_integrator = 3.2.0`\n- `enterprise_manager_for_mysql_database = 12.1.0.4.0`\n- `financial_services_analytical_applications_infrastructure >= 7.3.3.0.0, <= 7.3.5.3.0`\n- `financial_services_analytical_applications_infrastructure >= 8.0.0.0.0, <= 8.0.9.0.0`\n- `fmw_platform = 12.2.1.2.0`\n- `fmw_platform = 12.2.1.3.0`\n- `health_sciences_empirica_inspections = 1.0.1.1`\n- `hospitality_guest_access = 4.2.0`\n- `hospitality_guest_access = 4.2.1`\n- `instantis_enterprisetrack = 17.1`\n- `instantis_enterprisetrack = 17.2`\n- `management_pack = 11.2.1.0.13`\n- `micros_lucas = 2.9.5`\n- `micros_retail_xbri_loss_prevention = 10.0.1`\n- `micros_retail_xbri_loss_prevention = 10.5.0`\n- `micros_retail_xbri_loss_prevention = 10.6.0`\n- `micros_retail_xbri_loss_prevention = 10.7.0`\n- `micros_retail_xbri_loss_prevention = 10.8.0`\n- `micros_retail_xbri_loss_prevention = 10.8.1`\n- `mysql_enterprise_monitor <= 3.3.6.3293`\n- `mysql_enterprise_monitor >= 3.4.0, <= 3.4.4.4226`\n- `mysql_enterprise_monitor >= 4.0.0, <= 4.0.0.5135`\n- `retail_advanced_inventory_planning = 13.2`\n- `retail_advanced_inventory_planning = 13.4`\n- `retail_advanced_inventory_planning = 14.1`\n- `retail_advanced_inventory_planning = 15.0`\n- `retail_back_office = 14.0.4`\n- `retail_back_office = 14.1.3`\n- `retail_central_office = 14.0.4`\n- `retail_central_office = 14.1.3`\n- `retail_convenience_and_fuel_pos_software = 2.1.132`\n- `retail_eftlink = 1.1.124`\n- `retail_eftlink = 15.0.1`\n- `retail_eftlink = 16.0.2`\n- `retail_insights = 14.0`\n- `retail_insights = 14.1`\n- `retail_insights = 15.0`\n- `retail_insights = 16.0`\n- `retail_invoice_matching = 12.0`\n- `retail_invoice_matching = 13.0`\n- `retail_invoice_matching = 13.1`\n- `retail_invoice_matching = 13.2`\n- `retail_invoice_matching = 14.0`\n- `retail_invoice_matching = 14.1`\n- `retail_invoice_matching = 15.0`\n- `retail_invoice_matching = 16.0`\n- `retail_order_broker = 5.0`\n- `retail_order_broker = 5.1`\n- `retail_order_broker = 5.2`\n- `retail_order_broker = 15.0`\n- `retail_order_broker = 16.0`\n- `retail_order_management_system = 4.0`\n- `retail_order_management_system = 4.5`\n- `retail_order_management_system = 4.7`\n- `retail_order_management_system = 5.0`\n- `retail_point-of-service = 14.0.4`\n- `retail_point-of-service = 14.1.3`\n- `retail_price_management = 12.0`\n- `retail_price_management = 13.0`\n- `retail_price_management = 13.1`\n- `retail_price_management = 13.2`\n- `retail_price_management = 14.0`\n- `retail_price_management = 14.1`\n- `retail_price_management = 15.0`\n- `retail_price_management = 16.0`\n- `retail_returns_management = 2.3.8`\n- `retail_returns_management = 2.4.9`\n- `retail_returns_management = 14.0.4`\n- `retail_returns_management = 14.1.3`\n- `retail_store_inventory_management = 12.0.12`\n- `retail_store_inventory_management = 13.0.7`\n- `retail_store_inventory_management = 13.1.9`\n- `retail_store_inventory_management = 13.2.9`\n- `retail_store_inventory_management = 14.0.4`\n- `retail_store_inventory_management = 14.1.3`\n- `retail_store_inventory_management = 15.0.2`\n- `retail_store_inventory_management = 16.0.1`\n- `retail_xstore_point_of_service = 6.0.11`\n- `retail_xstore_point_of_service = 7.0.6`\n- `retail_xstore_point_of_service = 7.1.6`\n- `retail_xstore_point_of_service = 15.0.1`\n- `transportation_management = 6.3.1`\n- `transportation_management = 6.3.2`\n- `transportation_management = 6.3.3`\n- `transportation_management = 6.3.4`\n- `transportation_management = 6.3.5`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `tomcat 9.0.1`","depth":"abyssal","depthScore":90,"depthScoreParts":{"impact":44.6,"likelihood":20,"exploitation":25,"ransomware":0},"changes":[]}