Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2019-0232

93
FAUCET Score

CVE-2019-0232 is a Remote Code Execution vulnerability in Apache Tomcat's CGI Servlet when running on Windows with enableCmdLineArguments enabled. This flaw, affecting Tomcat versions 7.0.0 to 9.0.17, stems from a bug in how the JRE passes command-line arguments. It carries a CVSS score of 8.1 (HIGH) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While not on the KEV catalog, exploit modules are publicly available in Metasploit and Nuclei, and it has garnered significant community discussion and media coverage, indicating a high potential for exploitation.

Impacted Technologies

VendorProductVersion(s)CPE
>= 7.0.0, <= 7.0.93CPE matchmatch criteria
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
>= 8.5.0, <= 8.5.39CPE matchmatch criteria
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
>= 9.0.1, <= 9.0.17CPE matchmatch criteria
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
9.0.0CPE matchmatch criteria
cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*
9.0.0CPE matchmatch criteria
cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

8.1HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
2.2
Impact Score
5.9
CvssVersion
3.0

Exploit Intelligence

EPSS Score
99.65%
Probability of exploitation in next 30 days
EPSS Percentile
99.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
Metasploit: Apache Tomcat CGIServlet enableCmdLineArguments Vulnerability · Apr 10, 2019
Nuclei: CVE-2019-0232 · Sep 23, 2024
ExploitDB: EDB-47073 · Jul 3, 2019
This CVE's current EPSS score of 0.9965 is in the 100th percentile among its peer group of 8,914 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (25)

redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 3.1Fixed in: tomcat7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 3.1Fixed in: tomcat8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 6Fixed in: jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 6Fixed in: jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 6Fixed in: jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 6Fixed in: jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 6Fixed in: jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 6Fixed in: jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 6Fixed in: jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 7Fixed in: jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 7Fixed in: jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 7Fixed in: jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 7Fixed in: jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 7Fixed in: jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 7Fixed in: jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 7Fixed in: jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 8Fixed in: jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 8Fixed in: jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 8Fixed in: jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 8Fixed in: jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 8Fixed in: jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 8Fixed in: jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Server 5.2 on RHEL 8Fixed in: jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws
View patch
redhatend of lifevia redhat_api
Product: Red Hat JBoss Enterprise Web Server 2Fixed in: tomcat6
redhatend of lifevia redhat_api
Product: Red Hat JBoss Enterprise Web Server 2Fixed in: tomcat7

Vendor Advisories (2)

mavenGHSA-8vmx-qmch-mpqghigh

Apache Tomcat OS Command Injection vulnerability

Apr 18, 2019
redhatCVE-2019-0232Important

tomcat: Remote Code Execution on Windows

Apr 10, 2019

References

packetstormsecurity.com / files/153506/Apache-Tomcat-CGIServlet-enableCmdLineArguments-Remote-Code-Execution.html
access.redhat.com / errata/RHSA-2019:1712
blog.trendmicro.com / trendlabs-security-intelligence/uncovering-cve-2019-0232-a-remote-code-execution-vulnerability-in-apache-tomcat
codewhitesec.blogspot.com / 2016/02/java-and-command-line-injections-in-windows.html
Third Party Advisory
seclists.org / fulldisclosure/2019/May/4
lists.apache.org / thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E
lists.apache.org / thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E
lists.apache.org / thread.html/52ffb9fbf661245386a83a661183d13f1de2e5779fa23837a08e02ac%40%3Ccommits.ofbiz.apache.org%3E
lists.apache.org / thread.html/5f297a4b9080b5f65a05bc139596d0e437d6a539b25e31d29d028767%40%3Cannounce.tomcat.apache.org%3E
lists.apache.org / thread.html/673b6148d92cd7bc99ea2dcf85ad75d57da44fc322d51f37fb529a2a%40%3Ccommits.ofbiz.apache.org%3E
lists.apache.org / thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E
lists.apache.org / thread.html/96849486813a95dfd542e1618b7923ca945508aaf4a4341f674d83e3%40%3Cnotifications.ofbiz.apache.org%3E
lists.apache.org / thread.html/a6c87a09a71162fd563ab1c4e70a08a103e0b7c199fc391f1c9c4c35%40%3Ccommits.ofbiz.apache.org%3E
lists.apache.org / thread.html/dd4b325cdb261183dbf5ce913c102920a8f09c26dae666a98309165b%40%3Cnotifications.ofbiz.apache.org%3E
lists.apache.org / thread.html/f4d48b32ef2b6aa49c8830241a9475da5b46e451f964b291c7a0a715%40%3Cdev.tomcat.apache.org%3E
lists.apache.org / thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E
lists.apache.org / thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E
lists.apache.org / thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E
lists.apache.org / thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
lists.apache.org / thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
lists.apache.org / thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E
security.netapp.com / advisory/ntap-20190419-0001
Third Party Advisory
web.archive.org / web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way
Third Party Advisory
broadcom.com / support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-784
Technical Description
oracle.com / security-alerts/cpuapr2020.html
oracle.com / security-alerts/cpuApr2021.html
oracle.com / security-alerts/cpujan2020.html
oracle.com / technetwork/security-advisory/cpujul2019-5072835.html
oracle.com / technetwork/security-advisory/cpuoct2019-5072832.html
wwws.nightwatchcybersecurity.com / 2019/04/30/remote-code-execution-rce-in-cgi-servlet-apache-tomcat-on-windows-cve-2019-0232
synology.com / security/advisory/Synology_SA_19_17
securityfocus.com / bid/107906
Third Party AdvisoryVDB Entry