漏洞描述
在启用了enableCmdLineArguments的Windows上运行时，Apache Tomcat 9.0.0.M1到9.0.17,8.5.0到8.5.39和7.0.0到7.0.93中的CGI Servlet很容易受到远程执行代码的影响JRE将命令行参数传递给Windows的方式。
Apache Tomcat CGIServlet远程代码执行漏洞
PoC代码
暂无相关漏洞推荐
- Apache Tomcat URL重写绕过漏洞 （CVE-2025-55752）
- tomcat-default-login: Apahce Tomcat Manager Default Login
- POC CVE-2020-13935: Apache Tomcat WebSocket Frame Payload Length Validation Denial of Service
- POC CVE-2007-2449: Apache Tomcat 4.x-7.x - Cross-Site Scripting
- CVE-2016-8735: Apache Tomcat - Remote Code Execution via JMX Ports
- POC CVE-2017-12615: Apache Tomcat Servers - Remote Code Execution
- POC CVE-2017-12617: Apache Tomcat - Remote Code Execution
- POC CVE-2018-11759: Apache Tomcat JK Connect <=1.2.44 - Manager Access
- POC CVE-2018-11784: Apache Tomcat - Open Redirect
- POC CVE-2019-0221: Apache Tomcat - Cross-Site Scripting
- POC CVE-2019-0232: Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution
- POC CVE-2020-9484: Apache Tomcat Remote Command Execution
- POC CVE-2025-24813: Apache Tomcat Path Equivalence - Remote Code Execution