Non notée
CVE-2019-0221 The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided…
Description
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Tomcat | Versions non publiées |
Références
- 20190529 XSS in SSI printenv command - Apache Tomcat - CVE-2019-0221 seclists.org
- [debian-lts-announce] 20190530 [SECURITY] [DLA 1810-1] tomcat7 security update lists.debian.org
- 108545 www.securityfocus.com
- FEDORA-2019-1a3f878d27 lists.fedoraproject.org
- openSUSE-SU-2019:1673 lists.opensuse.org
- FEDORA-2019-d66febb5df lists.fedoraproject.org
- openSUSE-SU-2019:1808 lists.opensuse.org
- [debian-lts-announce] 20190813 [SECURITY] [DLA 1883-1] tomcat8 security update lists.debian.org
- USN-4128-1 usn.ubuntu.com
- USN-4128-2 usn.ubuntu.com
- RHSA-2019:3929 access.redhat.com
- RHSA-2019:3931 access.redhat.com
- DSA-4596 www.debian.org
- 20191229 [SECURITY] [DSA 4596-1] tomcat8 security update seclists.org
- [announce] 20200131 Apache Software Foundation Security Report: 2019 lists.apache.org
- [tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ lists.apache.org
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ lists.apache.org
- GLSA-202003-43 security.gentoo.org
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- lists.apache.org lists.apache.org
- security.netapp.com security.netapp.com
- wwws.nightwatchcybersecurity.com wwws.nightwatchcybersecurity.com
- support.f5.com support.f5.com
- packetstormsecurity.com packetstormsecurity.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Tomcat
Les 5 CVE de Apache Tomcat →
CVE-2020-11996
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and…
Non notée
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
9.8
Critique
CVE-2020-1935
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach…
Non notée
CVE-2019-17569
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression
Non notée