GitHub Advisoryadvisory · Maven

GHSA-jjpq-gp5q-8q6w Cross-site scripting in Apache Tomcat

MEDIUM Published 2019-05-30 Modified 2026-06-18 Official page ↗
Aliases
CVE-2019-0221
Ecosystem
Maven
Packages
org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2019-05-30

Affected packages

• Maven org.apache.tomcat.embed:tomcat-embed-core: >= 9.0.0, < 9.0.17 → fixed in 9.0.17 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 8.5.0, < 8.5.40 → fixed in 8.5.40 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 7.0.0, < 7.0.94 → fixed in 7.0.94 • Maven org.apache.tomcat:tomcat-catalina: >= 9.0.0, < 9.0.17 → fixed in 9.0.17 • Maven org.apache.tomcat:tomcat-catalina: >= 8.5.0, < 8.5.40 → fixed in 8.5.40 • Maven org.apache.tomcat:tomcat-catalina: >= 7.0.0, < 7.0.94 → fixed in 7.0.94 • Maven org.apache.tomcat:tomcat: >= 9.0.0, < 9.0.17 → fixed in 9.0.17 • Maven org.apache.tomcat:tomcat: >= 8.5.0, < 8.5.40 → fixed in 8.5.40 • Maven org.apache.tomcat:tomcat: >= 7.0.0, < 7.0.94 → fixed in 7.0.94

Description

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.

Related

Alias · CVE (1)

  • CVE-2019-0221 The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References