Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2019-0221

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Apache Tomcat

  • Apache Tomcat 9.0.0.M1 to 9.0.0.17affected
  • 8.5.0 to 8.5.39affected
  • 7.0.0 to 7.0.93affected

References