{"cve":"CVE-2019-0232","nvd":{"published":"2019-04-15T15:29:00.420","modified":"2026-06-17T02:08:02.930","status":"Modified","description":"When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1},"cwes":["CWE-78"],"references":["http://packetstormsecurity.com/files/153506/Apache-Tomcat-CGIServlet-enableCmdLineArguments-Remote-Code-Execution.html","http://seclists.org/fulldisclosure/2019/May/4","http://www.securityfocus.com/bid/107906","https://access.redhat.com/errata/RHSA-2019:1712","https://blog.trendmicro.com/trendlabs-security-intelligence/uncovering-cve-2019-0232-a-remote-code-execution-vulnerability-in-apache-tomcat/"],"products":["apache:tomcat"],"source":"nvd","synced_at":"2026-10-19T20:56:19.218283075+00:00"},"epss":{"cve":"CVE-2019-0232","score":0.99923,"percentile":0.99969,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-8vmx-qmch-mpqg","url":"https://osv.dev/vulnerability/GHSA-8vmx-qmch-mpqg","summary":"Apache Tomcat OS Command Injection vulnerability","modified":"2024-03-16T05:19:17.739703Z","packages":[{"ecosystem":"Maven","name":"org.apache.tomcat.embed:tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core","ranges":[">=9.0.0.M1 <9.0.17"],"fixed":["9.0.17"]},{"ecosystem":"Maven","name":"org.apache.tomcat.embed:tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core","ranges":[">=8.0.0 <8.5.40"],"fixed":["8.5.40"]},{"ecosystem":"Maven","name":"org.apache.tomcat.embed:tomcat-embed-core","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core","ranges":[">=7.0.0 <7.0.94"],"fixed":["7.0.94"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}