CVE-2017-12616: Apache Tomcat VirtualDirContext security constraint bypass and JSP source disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.5 with network reachability, no authentication and high confidentiality impact, plus a very high EPSS score, though no KEV listing or known exploit tags.

What it is

Apache Tomcat 7.0.0 through 7.0.80 fails to properly enforce security constraints when a VirtualDirContext is configured, allowing a specially crafted request to bypass those constraints and/or read the source code of JSPs served by that context. This matters because protected resources can be reached without authorization and JSP source may expose application logic or embedded secrets.

Impact

An unauthenticated remote attacker can access resources that security constraints were meant to protect and can read JSP source code, gaining information that aids further attacks.

Attack surface

Reachable over the network via HTTP requests to a Tomcat instance that uses a VirtualDirContext; the CVSS vector shows no privileges and no user interaction required.

Exploitation

Not listed in CISA KEV and no ransomware usage documented, but EPSS is high at roughly 0.70 (99th percentile), indicating elevated likelihood of exploitation activity; references are advisories and vendor errata only, with no public exploit tags.

What to do

• Upgrade Apache Tomcat to a version later than 7.0.80 that fixes this issue, or apply the vendor-supplied patch for your distribution.
• If VirtualDirContext is not required, remove it from the Tomcat configuration to eliminate the vulnerable code path.
• Apply the referenced Red Hat, Debian, Ubuntu, NetApp, HPE and Synology vendor updates where Tomcat is bundled.
• Restrict network access to Tomcat HTTP/connector ports to trusted clients only.
• Review security constraints on VirtualDirContext-served resources and confirm they are enforced after patching.

Detection

• Search Tomcat access logs for requests to JSP paths under VirtualDirContext mappings that return 200 with unexpected content or unusual URL encodings.
• Monitor for requests attempting path traversal or crafted encodings against JSP resources on Tomcat 7.0.x hosts.
• Inventory Tomcat instances and flag any running 7.0.0 through 7.0.80 with VirtualDirContext configured.
• Alert on access to JSP source files or protected paths that should require authentication.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.