{"id":"CVE-2019-0232","published":"2019-04-15T14:23:52Z","modified":"2024-08-04T17:44:15Z","title":"When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17…","vendor":"Apache","product":"Tomcat","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache","product":"Tomcat","versions":["9.0.0.M1 to 9.0.17","8.5.0 to 8.5.39","7.0.0 to 7.0.93"]}],"description":{"text":"When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).","provenance":"source","from":"CVE.org"},"summary":{"text":"The CGI Servlet in Apache Tomcat 9.0.0.M1 through 9.0.17, 8.5.0 through 8.5.39 and 7.0.0 through 7.0.93 on Windows passes command line arguments through the JRE in a way that can be abused for remote code execution, when the enableCmdLineArguments option is enabled. An attacker able to send requests to the CGI Servlet can achieve code execution on the host, provided the servlet is enabled (it is disabled by default) and enableCmdLineArguments is turned on.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:17:59Z"},"cvss":null,"epss":{"score":0.99923,"percentile":0.99969,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2021-04-12","exploitedFirstSeen":"2021-04-12","ransomware":false,"evidence":[{"url":"https://unit42.paloaltonetworks.com/network-attack-trends-winter-2020/","date":"2021-04-12"},{"url":"https://www.ic3.gov/Media/News/2022/220126.pdf","date":"2022-01-26"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/5f297a4b9080b5f65a05bc139596d0e437d6a539b25e31d29d028767%40%3Cannounce.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/673b6148d92cd7bc99ea2dcf85ad75d57da44fc322d51f37fb529a2a%40%3Ccommits.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/a6c87a09a71162fd563ab1c4e70a08a103e0b7c199fc391f1c9c4c35%40%3Ccommits.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/52ffb9fbf661245386a83a661183d13f1de2e5779fa23837a08e02ac%40%3Ccommits.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/dd4b325cdb261183dbf5ce913c102920a8f09c26dae666a98309165b%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/96849486813a95dfd542e1618b7923ca945508aaf4a4341f674d83e3%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.securityfocus.com/bid/107906","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://lists.apache.org/thread.html/f4d48b32ef2b6aa49c8830241a9475da5b46e451f964b291c7a0a715%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://seclists.org/fulldisclosure/2019/May/4","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1712","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC"]},{"url":"https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html","tags":["x_refsource_MISC"]},{"url":"https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/","tags":["x_refsource_MISC"]},{"url":"https://www.synology.com/security/advisory/Synology_SA_19_17","tags":["x_refsource_CONFIRM"]},{"url":"https://security.netapp.com/advisory/ntap-20190419-0001/","tags":["x_refsource_CONFIRM"]},{"url":"https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-784","tags":["x_refsource_CONFIRM"]},{"url":"https://blog.trendmicro.com/trendlabs-security-intelligence/uncovering-cve-2019-0232-a-remote-code-execution-vulnerability-in-apache-tomcat/","tags":["x_refsource_MISC"]},{"url":"https://wwws.nightwatchcybersecurity.com/2019/04/30/remote-code-execution-rce-in-cgi-servlet-apache-tomcat-on-windows-cve-2019-0232/","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/153506/Apache-Tomcat-CGIServlet-enableCmdLineArguments-Remote-Code-Execution.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=9.0.0.M1, <9.0.17",">=8.0.0, <8.5.40",">=7.0.0, <7.0.94"],"patched":["9.0.17","8.5.40","7.0.94"],"from":["GHSA-8vmx-qmch-mpqg"],"provenance":"source"}],"advisories":[{"id":"GHSA-8vmx-qmch-mpqg","url":"https://github.com/advisories/GHSA-8vmx-qmch-mpqg","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=9.0.0.M1, <9.0.17"],"patched":["9.0.17"],"provenance":"source","from":"GHSA"},{"id":"GHSA-8vmx-qmch-mpqg","url":"https://github.com/advisories/GHSA-8vmx-qmch-mpqg","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=8.0.0, <8.5.40"],"patched":["8.5.40"],"provenance":"source","from":"GHSA"},{"id":"GHSA-8vmx-qmch-mpqg","url":"https://github.com/advisories/GHSA-8vmx-qmch-mpqg","severity":"HIGH","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=7.0.0, <7.0.94"],"patched":["7.0.94"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2019-0411","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0411","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":47073,"url":"https://www.exploit-db.com/exploits/47073","title":"Apache Tomcat - CGIServlet enableCmdLineArguments Remote Code Execution (Metasploit)","type":"remote","platform":"windows","date":"2019-07-03","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2019-07-03"},"pocGithub":{"count":12,"skipped":3,"earliest":"2019-04-15","earliestUrl":"https://github.com/pyn3rd/CVE-2019-0232","repos":[{"name":"pyn3rd/CVE-2019-0232","url":"https://github.com/pyn3rd/CVE-2019-0232","stars":190,"created":"2019-04-15"},{"name":"jas502n/CVE-2019-0232","url":"https://github.com/jas502n/CVE-2019-0232","stars":82,"created":"2019-04-16"},{"name":"jaiguptanick/CVE-2019-0232","url":"https://github.com/jaiguptanick/CVE-2019-0232","stars":33,"created":"2021-03-25"},{"name":"setrus/CVE-2019-0232","url":"https://github.com/setrus/CVE-2019-0232","stars":20,"created":"2019-11-21"},{"name":"cyy95/CVE-2019-0232-EXP","url":"https://github.com/cyy95/CVE-2019-0232-EXP","stars":3,"created":"2019-05-23"}]},"metasploit":[{"name":"Apache Tomcat CGIServlet enableCmdLineArguments Vulnerability","module":"exploit/windows/http/tomcat_cgi_cmdlineargs","type":"exploit","disclosureDate":"2019-04-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/tomcat_cgi_cmdlineargs.rb"}],"nuclei":[{"id":"CVE-2019-0232","name":"Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution","severity":"high","path":"http/cves/2019/CVE-2019-0232.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-0232.yaml"}],"first":{"date":"2019-04-10","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/tomcat_cgi_cmdlineargs.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/153506/Apache-Tomcat-CGIServlet-enableCmdLineArguments-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2019-04-10","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2019-04-15, Exploit-DB 2019-07-03","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/tomcat_cgi_cmdlineargs.rb","provenance":"source"},{"date":"2019-04-15","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-0232","provenance":"source"},{"date":"2021-04-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://unit42.paloaltonetworks.com/network-attack-trends-winter-2020/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":60.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2026 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 NVD exploit link; 12 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2018-11784","published":"2018-10-04","fixed":"9.0.12","kev":false,"link":{"from":"CVE-2018-11784","to":"CVE-2019-0232","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"7.0.91","toFixed":"7.0.94","daysApart":193}]}},{"cve":"CVE-2019-0199","published":"2019-04-10","fixed":"9.0.16","kev":false,"link":{"from":"CVE-2019-0199","to":"CVE-2019-0232","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"8.5.38","toFixed":"8.5.40","daysApart":5},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat.embed:tomcat-embed-core","fromFixed":"9.0.16","toFixed":"9.0.17","daysApart":5}]}},{"cve":"CVE-2019-0221","published":"2019-05-28","fixed":"9.0.17","kev":false},{"cve":"CVE-2019-0232","published":"2019-04-15","fixed":"9.0.17","kev":false},{"cve":"CVE-2019-10072","published":"2019-06-21","fixed":"9.0.20","kev":false},{"cve":"CVE-2019-12418","published":"2019-12-23","fixed":"9.0.29","kev":false},{"cve":"CVE-2019-17563","published":"2019-12-23","fixed":"9.0.30","kev":false}],"package":"Maven:org.apache.tomcat.embed:tomcat-embed-core"}}