CVE-2019-0221
- State
- Published
- Severity
- Not scored
- Published
- May 28, 2019
- Updated
- Nov 2, 2026
- Reserved
- Nov 14, 2018
Description
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Apache TomcatApache |
|
References
- 20190529 XSS in SSI printenv command - Apache Tomcat - CVE-2019-0221mailing-list
- [debian-lts-announce] 20190530 [SECURITY] [DLA 1810-1] tomcat7 security updatemailing-list
- 108545vdb-entry
- FEDORA-2019-1a3f878d27vendor-advisory
- openSUSE-SU-2019:1673vendor-advisory
- FEDORA-2019-d66febb5dfvendor-advisory
- openSUSE-SU-2019:1808vendor-advisory
- [debian-lts-announce] 20190813 [SECURITY] [DLA 1883-1] tomcat8 security updatemailing-list
- USN-4128-1vendor-advisory
- USN-4128-2vendor-advisory
- RHSA-2019:3929vendor-advisory
- RHSA-2019:3931vendor-advisory
- DSA-4596vendor-advisory
- 20191229 [SECURITY] [DSA 4596-1] tomcat8 security updatemailing-list
- [announce] 20200131 Apache Software Foundation Security Report: 2019mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/mailing-list
- GLSA-202003-43vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://lists.apache.org/thread.html/6e6e9eacf7b28fd63d249711e9d3ccd4e0a83f556e324aee37be5a8c%40%3Cannounce.tomcat.apache.org%3E
- https://security.netapp.com/advisory/ntap-20190606-0001/
- https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/
- https://support.f5.com/csp/article/K13184144?utm_source=f5support&%3Butm_medium=RSS
- http://packetstormsecurity.com/files/163457/Apache-Tomcat-9.0.0.M1-Cross-Site-Scripting.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.