CVE-2019-0232
Apache Tomcat: CGI servlet remote code execution on Windows
Technology
Apache Tomcat
CVSS Score
8.1 / 10.0
Affected Versions
9.0.0.M1 to 9.0.17; 8.5.0 to 8.5.39; 7.0.0 to 7.0.93
Upstream Fix
9.0.19; 8.5.40; 7.0.94
Published
April 15, 2019
OSSeva Coverage
Fixed upstream
Description
When running on Windows with enableCmdLineArguments enabled, the CGI servlet was vulnerable to remote code execution because of the way the JRE passes command line arguments to Windows. The CGI servlet is disabled by default. Fixed in 9.0.19 (the 9.0.18 release vote did not pass), 8.5.40 and 7.0.94.
Is your Apache Tomcat deployment affected?
If you're running 9.0.0.M1 to 9.0.17; 8.5.0 to 8.5.39; 7.0.0 to 7.0.93, you need this patch. Book a discovery call to get covered.
Get a quote
Running Apache Tomcat 9.0.0.M1 to 9.0.17; 8.5.0 to 8.5.39; 7.0.0 to 7.0.93?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?