DEBIAN-CVE-2019-0221
- Source
- https://security-tracker.debian.org/tracker/CVE-2019-0221
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2019-0221.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2019-0221
- Upstream
- Downstream
- Published
- 2019-05-28T22:29:00Z
- Modified
- 2026-09-09T07:00:13Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
- References
Affected packages
Debian:12 / tomcat9
Package
- Name
- tomcat9
- Purl
- pkg:deb/debian/tomcat9?arch=source&distro=bookworm
Debian:13 / tomcat9
Package
- Name
- tomcat9
- Purl
- pkg:deb/debian/tomcat9?arch=source&distro=trixie
Debian:14 / tomcat9
Package
- Name
- tomcat9
- Purl
- pkg:deb/debian/tomcat9?arch=source&distro=forky