CVE-2019-0232
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0…
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).
- Vendor
- apache
- Product
- tomcat
- CVSS 3.0
- 8.1 (high), scored by NVD (primary)CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-78
- Published
- 2019-04-15
- NVD modified
- 2026-06-17
- NVD status
- Modified
Not in the CISA KEV catalogue at the last update.
EPSS
100% chance of exploitation in the next 30 days (percentile 99th)
FIRST EPSS, updated 17 Oct 2026. About EPSS
CVSS is severity, EPSS is likelihood, KEV means already exploited. EPSS is a statistical probability, not a certainty: a low score does not make a bug safe, and a high one does not prove it is being exploited.
References
- packetstormsecurity.com
- seclists.org
- www.securityfocus.com (Third Party Advisory, VDB Entry)
- access.redhat.com
- blog.trendmicro.com
- codewhitesec.blogspot.com (Third Party Advisory)
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
Data last updated 18 Oct 2026. Sources: NVD API 2.0, FIRST EPSS. Links: NVD, CISA KEV. Metadata only. ThreatWire does not host exploit code.