CVE-2019-0232: Apache Tomcat CGI Servlet command injection on Windows

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityRemote code execution with no authentication required, but exploitation depends on a non-default Windows configuration, and the CVSS score is 8.1 (HIGH).

What it is

The CGI Servlet in Apache Tomcat on Windows is vulnerable to OS command injection when enableCmdLineArguments is enabled, because the JRE mishandles quoting of command line arguments. An attacker can inject commands through request parameters, leading to remote code execution. The CGI Servlet and enableCmdLineArguments are both disabled by default, so exposure requires non-default configuration.

Impact

An attacker who can reach the CGI Servlet gains remote code execution with the privileges of the Tomcat process. This allows arbitrary command execution, data theft, and full host compromise.

Attack surface

Reachable over the network via HTTP requests to the CGI Servlet on Windows; no authentication or user interaction is required per the CVSS vector (AV:N/PR:N/UI:N). Exploitation requires the non-default configuration of the CGI Servlet enabled with enableCmdLineArguments set to true.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high (0.99652, 99.9th percentile), indicating strong likelihood of exploitation activity. Public references include a Packet Storm advisory and a Trend Micro analysis, but no reference is tagged as an exploit.

What to do

• Upgrade Apache Tomcat to a fixed release (9.0.18 or later, 8.5.40 or later, 7.0.94 or later) where enableCmdLineArguments is disabled by default.
• If the CGI Servlet is not required, disable it entirely by removing or commenting out the CGI servlet and servlet-mapping in conf/web.xml.
• If CGI is required, ensure enableCmdLineArguments is set to false and restrict access to the CGI Servlet to trusted networks only.
• Run Tomcat with a least-privilege service account and apply network segmentation to limit the impact of command execution.
• Monitor Apache and Tomcat security advisories for any further guidance on this issue.

Detection

• Inspect Tomcat access logs for requests to CGI paths containing shell metacharacters such as &, |, ;, or %26, %7C, %3B.
• Monitor for unexpected child processes spawned by the Tomcat Java process, especially cmd.exe or other command interpreters.
• Audit Tomcat configuration files (web.xml, server.xml) for enabled CGI Servlet and enableCmdLineArguments=true.
• Alert on outbound network connections or file writes originating from the Tomcat process that are not part of normal application behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.