CVE-2019-0232 Apache Tomcat
| Affected software | Apache Tomcat |
|---|---|
| Severity | 8.1 High CVSS 3.0 2 scores |
| Fixed in | 9.0.17, 8.5.40, 7.0.94 |
| Weakness | OS command injection (CWE-78) |
| Published | 15 Apr 2019 |
| Updated | 2 Nov 2026 |
Description
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).
Exploitation status
Exploited
Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV listed Exploitation reported in the wild. 2 citations · 12 exploits · earliest 2021-04-12.
- CISA Vulnrichment exploitation: none
- Indexed PoC 15 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2019-04-15.
- EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2019-0232 in VulnCheck (free account), which lists 7 more exploit references not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Reported exploitation | unit42.paloaltonetworks.com | /network-attack-trends-winter-2020 | 2021-04-12 |
| Reported exploitation | ic3.gov | /Media/News/2022/220126.pdf | 2022-01-26 |
| Exploit reference | VulnCheck XDB c78c5341fccf | Exploit type: initial-access | 2019-04-15 |
| Exploit reference | VulnCheck XDB 775149bbfff6 | Exploit type: initial-access | 2019-04-16 |
| Exploit reference | VulnCheck XDB 7dd567105f1f | Exploit type: initial-access | 2019-05-23 |
| Exploit reference | VulnCheck XDB 67571ae1c53c | Exploit type: initial-access | 2021-03-25 |
| Exploit reference | VulnCheck XDB 783921b65e93 | Exploit type: initial-access | 2024-12-29 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Apache Tomcat Remote Code Execution on Windows | 190 | 2019-04-15 |
| Nuclei | Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution | ||
| Exploit-DB | Apache Tomcat - CGIServlet enableCmdLineArguments Remote Code Execution (Metasploit) | 2019-07-03 | |
| Metasploit | Apache Tomcat CGIServlet enableCmdLineArguments Vulnerability (excellent rank) | ||
| GitHub PoC | Apache Tomcat Remote Code Execution on Windows - CGI-BIN | 81 | 2019-04-16 |
| GitHub PoC | Vulnerability analysis and PoC for the Apache Tomcat - CGIServlet enableCmdLineArguments Remote Code Execution (RCE) | 33 | 2021-03-25 |
| GitHub PoC | CVE-2019-0232-Remote Code Execution on Apache Tomcat 7.0.42 | 21 | 2019-11-21 |
| GitHub PoC | cyy95/CVE-2019-0232-EXP | 3 | 2019-05-23 |
| GitHub PoC | Hi this is a revised and enhanced code for CVE-2019-0232 | 2 | 2024-12-29 |
| GitHub PoC | CVE-2019-0232 - Apache Tomcat CGIServlet enableCmdLineArguments RCE - PoC Exploit | 1 | 2026-07-12 |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Process
- Action available security rule
- Review automated Inferred
- Record active
| Decided by | A vulnerability class already blocked by an ARMR security rule |
|---|---|
| Finding | Protected by Waratek's ARMR command-injection security rule, which blocks this class of attack at the JVM level without a rule written for this CVE specifically. The CVE's weakness is CWE-78: OS Command Injection. |
How to mitigate CVE-2019-0232
Upgrade Apache Tomcat to a release that fixes it: 9.0.17, 8.5.40 or 7.0.94. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
8.1 HIGH
v3.0 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
CVSS
8.1 HIGH v3.0CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.0 | 8.1 | HIGH | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 2.0 | 9.3 | none | AV:N/AC:M/Au:N/C:C/I:C/A:C |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update January 2020 ↗ | CPU | 2020-Q1 | Oracle Supply Chain / Install (Apache Tomcat) (6.2.0, 6.2.1) |
| Oracle Critical Patch Update October 2019 ↗ | CPU | 2019-Q4 | Oracle Construction and Engineering / Generic (Apache Tomcat) (17.1, 17.2, 17.3) Oracle Retail Applications / Internal Operations (Apache Tomcat) (11.4) Oracle Supply Chain / Security (Apache Tomcat) (9.3.3-9.3.6) |
| Oracle Critical Patch Update July 2019 ↗ | CPU | 2019-Q3 | Oracle Retail Applications / Upgrade Install (Apache Tomcat) (5.2, 15.0) Oracle Supply Chain Products Suite / Install (Apache Tomcat) (6.3.7) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Construction and Engineering | Generic (Apache Tomcat) | 17.1, 17.2, 17.3 | 17.1 · 17.2 · 17.3 |
| Oracle Retail Applications | Internal Operations (Apache Tomcat) | 11.4 | 11.4 |
| Oracle Retail Applications | Upgrade Install (Apache Tomcat) | 5.2, 15.0 | 5.2 · 15.0 |
| Oracle Supply Chain | Install (Apache Tomcat) | 6.2.0, 6.2.1 | 6.2.0 · 6.2.1 |
| Oracle Supply Chain | Security (Apache Tomcat) | 9.3.3-9.3.6 | |
| Oracle Supply Chain Products Suite | Install (Apache Tomcat) | 6.3.7 | 6.3.7 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.tomcat.embed:tomcat-embed-core |
9.0.0.M1 | 9.0.17 |
unbounded |
org.apache.tomcat.embed:tomcat-embed-core |
8.0.0 | 8.5.40 |
unbounded |
org.apache.tomcat.embed:tomcat-embed-core |
7.0.0 | 7.0.94 |
unbounded |
Products and versions
2 products, 32 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | tomcat | generic | ≥ 7.0.0 and ≤ 7.0.93 · ≥ 8.5.0 and ≤ 8.5.39 · 9.0.0:milestone1 · 9.0.0:milestone10 · 9.0.0:milestone11 · 9.0.0:milestone12 · 9.0.0:milestone13 · 9.0.0:milestone14 · 9.0.0:milestone15 · 9.0.0:milestone16 · 9.0.0:milestone17 · 9.0.0:milestone18 · 9.0.0:milestone19 · 9.0.0:milestone2 · 9.0.0:milestone20 · 9.0.0:milestone21 · 9.0.0:milestone22 · 9.0.0:milestone23 · 9.0.0:milestone24 · 9.0.0:milestone25 · 9.0.0:milestone26 · 9.0.0:milestone3 · 9.0.0:milestone4 · 9.0.0:milestone5 · 9.0.0:milestone6 · 9.0.0:milestone7 · 9.0.0:milestone8 · 9.0.0:milestone9 · ≥ 9.0.1 and ≤ 9.0.17 |
| osv | org.apache.tomcat.embed | tomcat-embed-core | generic | ≥ 7.0.0 and ＜ 7.0.94 · ≥ 8.0.0 and ＜ 8.5.40 · ≥ 9.0.0 and ＜ 9.0.17 |
References
Timeline
Timeline
| Published | 2019-04-15 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2021-04-12 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| VulnCheck KEV: latest evidence | 2026-07-14 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| NVD record modified | 2026-11-02 | NVD's own last-modified date for this record. |