The vulnerability exists in the CGI Servlet, due to the way it passes the JRE command line arguments to the windows when running on with enableCmdLineArguments enabled.
Apache fixed the vulnerability by disabling the CGI option enableCmdLineArguments by default. This vulnerability can be tracked as
The bug was identified and reported to the Apache foundation by an external security researcher through the bug bounty program.
Apache recommends users to update with the following versions and to ensure CGI Servlet initialization parameter enableCmdLineArguments is set to false.
Upgrade to Apache Tomcat 9.0.18 or later when released
Upgrade to Apache Tomcat 8.5.40 or later when released
Upgrade to Apache Tomcat 7.0.93 or later when released