Apache foundation has released security updates to address vulnerability with Apache Tomcat that allows a remote attacker to exploit the vulnerability and to take control over the vulnerable machine.
The vulnerability exists in the CGI Servlet, due to the way it passes the JRE command line arguments to the windows when running on with enableCmdLineArguments enabled.
The bug was identified and reported to the Apache foundation by an external security researcher through the bug bounty program.
Apache Tomcat 9.0.0.M1 to 9.0.17
Apache Tomcat 8.5.0 to 8.5.39
Apache Tomcat 7.0.0 to 7.0.93
Apache recommends users to update with the following versions and to ensure CGI Servlet initialization parameter enableCmdLineArguments is set to false.
Upgrade to Apache Tomcat 9.0.18 or later when released
Upgrade to Apache Tomcat 8.5.40 or later when released
Upgrade to Apache Tomcat 7.0.93 or later when released