Apache Tomcat JSP Upload RCE

Impact: High


Apache Tomcat is susceptible to a Remote Code Execution (RCE) vulnerability when running on Windows with HTTP PUTs enabled. By sending a specially crafted request, attackers can upload a JSP file to the server. Subsequently, this JSP file can be requested, and any code it contains will be executed by the server.


To mitigate this vulnerability, it is recommended to upgrade to the latest stable version of Apache Tomcat. Additionally, ensure that the readonly parameter is set to true in the servlet configurations:



Last updated on May 13, 2024

This issue is available in SmartScanner Professional

See Pricing