CVE-2017-5664

CVE-2017-5664 describes a vulnerability in Apache Tomcat versions 7.0.0-7.0.77, 8.0.0.RC1-8.0.43, 8.5.0-8.5.14, and 9.0.0.M1-9.0.0.M20 where the Default Servlet incorrectly handled static error pages. When an error occurred, the original HTTP method was forwarded to the static error page instead of always treating it as a GET request. This could lead to unexpected behavior, including the potential replacement or removal of the custom error page if the DefaultServlet was configured to permit writes. The vulnerability has a CVSS v3 score of 7.5 (High), indicating a network-based attack with low complexity and no user interaction required, potentially leading to high integrity impact (modification or deletion of static error pages). There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal.