Patchfirst
Patchfirst
CVE-2019-0232 Public exploit EPSS 99.9%

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17…

Apache · Tomcat

Summary

The CGI Servlet in Apache Tomcat 9.0.0.M1 through 9.0.17, 8.5.0 through 8.5.39 and 7.0.0 through 7.0.93 on Windows passes command line arguments through the JRE in a way that can be abused for remote code execution, when the enableCmdLineArguments option is enabled. An attacker able to send requests to the CGI Servlet can achieve code execution on the host, provided the servlet is enabled (it is disabled by default) and enableCmdLineArguments is turned on.

Official description · CVE.org

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).

Breakdown
60.0 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 24 months after disclosure. Public exploit code (Metasploit) was available 5 days before disclosure.

  1. Public exploit codeMetasploit5 days before
  2. Disclosedday 0
  3. First seen exploitedVulnCheck KEV evidence+24 mo

7 fixes in tomcat-embed-core over 15 months. The latest fix listed for tomcat-embed-core is 9.0.30.

Fixes in tomcat-embed-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 9.0.12CVE-2018-117844 Oct 2018
  2. 9.0.16CVE-2019-019910 Apr 2019
  3. 9.0.17CVE-2019-023215 Apr 2019
  4. 9.0.17CVE-2019-022128 May 2019
  5. 9.0.20CVE-2019-1007221 Jun 2019
  6. 9.0.29CVE-2019-1241823 Dec 2019
  7. 9.0.30CVE-2019-1756323 Dec 2019Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.tomcat.embed:tomcat-embed-core.

Mavenorg.apache.tomcat.embed:tomcat-embed-coreGHSA-8vmx-qmch-mpqg

Upgrade to 9.0.109 or later

Fixes this CVE and 12 other known vulnerabilities in this package (CVE-2017-12617, CVE-2018-11784, +10).

Set the version to 9.0.109 or later in your pom.xml or build.gradle.

First fixed in 9.0.17 for CVE-2019-0232.

Affected versions, by release line

If you runUpgrade to
9.0.0.M1 up to 9.0.179.0.109first fix for this CVE: 9.0.17
8.0.0 up to 8.5.40

Still affected on this line by CVE-2025-24813 (no fix published); CVE-2025-31650 (no fix published); CVE-2025-55752 (no fix published).

8.5.94first fix for this CVE: 8.5.40
7.0.0 up to 7.0.947.0.104first fix for this CVE: 7.0.94

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

32 links, grouped by NVD tag

mailing-list 17

lists.apache.org/thread.html/5f297a4b9080b5f65a05bc139596d0e437d6a539b25e31d29d028767%40%3Cannounce.tomcat.apache.org%3Elists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/673b6148d92cd7bc99ea2dcf85ad75d57da44fc322d51f37fb529a2a%40%3Ccommits.ofbiz.apache.org%3Elists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/a6c87a09a71162fd563ab1c4e70a08a103e0b7c199fc391f1c9c4c35%40%3Ccommits.ofbiz.apache.org%3Elists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/52ffb9fbf661245386a83a661183d13f1de2e5779fa23837a08e02ac%40%3Ccommits.ofbiz.apache.org%3Elists.apache.org/thread.html/dd4b325cdb261183dbf5ce913c102920a8f09c26dae666a98309165b%40%3Cnotifications.ofbiz.apache.org%3E
Show 9 moreShow fewerlists.apache.org/thread.html/96849486813a95dfd542e1618b7923ca945508aaf4a4341f674d83e3%40%3Cnotifications.ofbiz.apache.org%3Elists.apache.org/thread.html/f4d48b32ef2b6aa49c8830241a9475da5b46e451f964b291c7a0a715%40%3Cdev.tomcat.apache.org%3Eseclists.org/fulldisclosure/2019/May/4lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3Elists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3Elists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E

vdb-entry 1

securityfocus.com/bid/107906

vendor-advisory 1

access.redhat.com/errata/RHSA-2019:1712

x_refsource_MISC 10

oracle.com/security-alerts/cpuapr2020.htmloracle.com/technetwork/security-advisory/cpujul2019-5072835.htmloracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmloracle.com/security-alerts/cpujan2020.htmloracle.com/security-alerts/cpuApr2021.htmlcodewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.htmlweb.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/blog.trendmicro.com/trendlabs-security-intelligence/uncovering-cve-2019-0232-a-remote-code-execution-vulnerability-in-apache-tomcat/wwws.nightwatchcybersecurity.com/2019/04/30/remote-code-execution-rce-in-cgi-servlet-apache-tomcat-on-windows-cve-2019-0232/packetstormsecurity.com/files/153506/Apache-Tomcat-CGIServlet-enableCmdLineArguments-Remote-Code-Execution.html

x_refsource_CONFIRM 3

synology.com/security/advisory/Synology_SA_19_17security.netapp.com/advisory/ntap-20190419-0001/broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-784
↑ ↓ chooseEnter openEsc close