A flaw was discovered in Apache Tomcat, where a Java Runtime Environment can pass a command-line argument in the Windows operating system. The execution of arbitrary commands via Tomcat's Common Gateway Interface (CGI) Servlet, allows an attacker to perform remote code execution.
Platform | Package | Release Date | Advisory |
---|---|---|---|
Amazon Linux 1 | tomcat8 | 2019-05-16 23:11 | ALAS-2019-1208 |
Score Type | Score | Vector | |
---|---|---|---|
Amazon Linux | CVSSv3 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
NVD | CVSSv2 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
NVD | CVSSv3 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |