Not rated
CVE-2019-0221 The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided…
Description
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Tomcat | Versions not published |
References
- 20190529 XSS in SSI printenv command - Apache Tomcat - CVE-2019-0221 seclists.org
- [debian-lts-announce] 20190530 [SECURITY] [DLA 1810-1] tomcat7 security update lists.debian.org
- 108545 www.securityfocus.com
- FEDORA-2019-1a3f878d27 lists.fedoraproject.org
- openSUSE-SU-2019:1673 lists.opensuse.org
- FEDORA-2019-d66febb5df lists.fedoraproject.org
- openSUSE-SU-2019:1808 lists.opensuse.org
- [debian-lts-announce] 20190813 [SECURITY] [DLA 1883-1] tomcat8 security update lists.debian.org
- USN-4128-1 usn.ubuntu.com
- USN-4128-2 usn.ubuntu.com
- RHSA-2019:3929 access.redhat.com
- RHSA-2019:3931 access.redhat.com
- DSA-4596 www.debian.org
- 20191229 [SECURITY] [DSA 4596-1] tomcat8 security update seclists.org
- [announce] 20200131 Apache Software Foundation Security Report: 2019 lists.apache.org
- [tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ lists.apache.org
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ lists.apache.org
- GLSA-202003-43 security.gentoo.org
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- lists.apache.org lists.apache.org
- security.netapp.com security.netapp.com
- wwws.nightwatchcybersecurity.com wwws.nightwatchcybersecurity.com
- support.f5.com support.f5.com
- packetstormsecurity.com packetstormsecurity.com
Timeline
- Published
- Last modified
Other CVEs of Apache Tomcat
The 5 CVEs of Apache Tomcat →
CVE-2020-11996
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and…
Not rated
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
9.8
Critical
CVE-2020-1935
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach…
Not rated
CVE-2019-17569
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression
Not rated