CVE-2019-0221

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is…

published May 28, 2019

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.1th percentile for exploit probability.

CVSS
—
EPSS
59%
Percentile
99.1
In the wild
Unconfirmed
What it is

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.59194 · 99.1th percentile
Published
2019-05-28T21:01Z
EPSS history
Timeline
  • 25 SEP 03:09Z
    EPSS moved 46% → 59%
    epss
  • 22 SEP 03:16Z
    EPSS moved 46% → 66%
    epss
  • 06 SEP 03:12Z
    EPSS moved 46% → 66%
    epss
  • 30 AUG 16:01Z
    EPSS moved 66% → 46%
    epss
  • 29 AUG 04:44Z
    EPSS moved 46% → 66%
    epss
  • 28 MAY 21:01Z
    The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is…
    cvelistv5