Skip to content
Fencer Intel
high 8.1

CVE-2019-0232 in the critical feed json

Apache Tomcat OS Command Injection vulnerability

published 2019-04-15 7 y ago modified 2026-11-02 7 d ago also GHSA-8vmx-qmch-mpqg , EUVD-2019-0411

cvss
8.1
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
99.9%
EPSS 99.9% chance of exploitation in 30 days, percentile 99.9%
public exploits
2
Metasploit, Exploit-DB, plus a Nuclei check

Summary

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).

Patch / fix

  • maven org.apache.tomcat.embed:tomcat-embed-core 7.0.94, 8.5.40, 9.0.17
  • jws5-ecj jboss enterprise web server 5.2 4.12.0-1.redhat_1.1.el6jws
  • jws5-ecj jboss enterprise web server 5.2 4.12.0-1.redhat_1.1.el7jws
  • jws5-ecj jboss enterprise web server 5.2 4.12.0-1.redhat_1.1.el8jws
  • jws5-tomcat jboss enterprise web server 5.2 9.0.21-10.redhat_4.1.el6jws
  • jws5-tomcat jboss enterprise web server 5.2 9.0.21-10.redhat_4.1.el7jws
  • jws5-tomcat jboss enterprise web server 5.2 9.0.21-10.redhat_4.1.el8jws
  • jws5-tomcat-lib jboss enterprise web server 5.2 9.0.21-10.redhat_4.1.el6jws
  • jws5-tomcat-lib jboss enterprise web server 5.2 9.0.21-10.redhat_4.1.el7jws

red hat advisories RHSA-2019:3929

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-0232 updated cvss 5.9

tomcat: Remote Code Execution on Windows

  • Red Hat JBoss Enterprise Web Server 2 tomcat6, tomcat6-lib, tomcat6-log4j, tomcat6-javadoc, tomcat6-webapps, tomcat7 tomcat7, +6 more
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Web Server 3.1
    fixed: vendor fix RHSA-2019:1712
  • Red Hat JBoss Web Server 5.2 for RHEL 6 Server jws5-ecj 4.12.0-1.redhat_1.1.el6jws, jws5-tomcat 9.0.21-10.redhat_4.1.el6jws, jws5-tomcat-lib 9.0.21-10.redhat_4.1.el6jws, jws5-javapackages-tools 3.4.1-5.15.11.el6jws, jws5-python-javapackages 3.4.1-5.15.11.el6jws, jws5-tomcat-native 1.2.21-34.redhat_34.el6jws, +13 more Red Hat JBoss Web Server 5.2 for RHEL 7 Server jws5-ecj 4.12.0-1.redhat_1.1.el7jws, jws5-tomcat 9.0.21-10.redhat_4.1.el7jws, jws5-tomcat-lib 9.0.21-10.redhat_4.1.el7jws, jws5-javapackages-tools 3.4.1-5.15.11.el7jws, jws5-python-javapackages 3.4.1-5.15.11.el7jws, jws5-tomcat-native 1.2.21-34.redhat_34.el7jws, +13 more Red Hat JBoss Web Server 5.2 for RHEL 8 jws5-ecj 4.12.0-1.redhat_1.1.el8jws, jws5-tomcat 9.0.21-10.redhat_4.1.el8jws, jws5-tomcat-lib 9.0.21-10.redhat_4.1.el8jws, jws5-javapackages-tools 3.4.1-5.15.11.el8jws, jws5-python-javapackages 3.4.1-5.15.11.el8jws, jws5-tomcat-native 1.2.21-34.redhat_34.el8jws, +13 more
    fixed: vendor fix RHSA-2019:3929
  • Red Hat BPM Suite 6 tomcat Red Hat Enterprise Linux 6 tomcat6, tomcat6-lib, tomcat6-log4j, tomcat6-javadoc, tomcat6-webapps, tomcat6-el-2.1-api, +4 more Red Hat Enterprise Linux 7 tomcat, tomcat-lib, tomcat-jsvc, tomcat-javadoc, tomcat-webapps, tomcat-el-2.2-api, +4 more Red Hat Enterprise Linux 8 pki-deps:10.6/pki-servlet-container Red Hat Fuse 7 tomcat Red Hat JBoss BRMS 5 jbossweb jbossweb
    +12 more products
    Red Hat JBoss BRMS 6 tomcat Red Hat JBoss Data Grid 6 jbossweb jbossweb Red Hat JBoss Data Grid 7 tomcat Red Hat JBoss Data Virtualization 6 jbossweb jbossweb Red Hat JBoss Enterprise Application Platform 5 jbossweb jbossweb Red Hat JBoss Enterprise Application Platform 6 jbossweb jbossweb Red Hat JBoss Fuse 6 tomcat Red Hat JBoss Fuse Service Works 6 jbossweb jbossweb Red Hat JBoss Operations Network 3 jbossweb jbossweb Red Hat JBoss SOA Platform 5 jbossweb jbossweb Red Hat OpenShift Application Runtimes tomcat Red Hat Software Collections rh-java-common-tomcat-lib, rh-java-common-tomcat-javadoc, rh-java-common-tomcat-el-2.2-api, rh-java-common-tomcat-jsp-2.2-api, rh-java-common-tomcat-servlet-3.0-api
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit exploit/windows/http/tomcat_cgi_cmdlineargs)
  2. Published

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
7 d ago

Exploit prediction

99.92% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

CVSS scores

assigned by version score vector
NVD 3.0 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C
GitHub 3.0 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.tomcat.embed:tomcat-embed-core
>=9.0.0.M1, <9.0.17
>=8.0.0, <8.5.40
>=7.0.0, <7.0.94
9.0.17
8.5.40
7.0.94

Affected products

  • Apache Tomcat

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.