QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2019-0221

Back to search

CVE-2019-0221

Published: May 28, 2019

Modified: Aug 4, 2024

PUBLISHED

Description

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.

VendorProductVersions

Apache

Apache Tomcat

affected
Apache Tomcat 9.0.0.M1 to 9.0.0.17
affected
8.5.0 to 8.5.39
affected
7.0.0 to 7.0.93

References

108545
vdb-entry
x_refsource_BID
FEDORA-2019-1a3f878d27
vendor-advisory
x_refsource_FEDORA
openSUSE-SU-2019:1673
vendor-advisory
x_refsource_SUSE
FEDORA-2019-d66febb5df
vendor-advisory
x_refsource_FEDORA
openSUSE-SU-2019:1808
vendor-advisory
x_refsource_SUSE
USN-4128-1
vendor-advisory
x_refsource_UBUNTU
USN-4128-2
vendor-advisory
x_refsource_UBUNTU
RHSA-2019:3929
vendor-advisory
x_refsource_REDHAT
RHSA-2019:3931
vendor-advisory
x_refsource_REDHAT
DSA-4596
vendor-advisory
x_refsource_DEBIAN
GLSA-202003-43
vendor-advisory
x_refsource_GENTOO

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now