6.1

CVE-2019-0221

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Tomcat Version >= 7.0.0 <= 7.0.93
Apache ≫ Tomcat Version >= 8.5.0 <= 8.5.39
Apache ≫ Tomcat Version >= 9.0.1 <= 9.0.17
Apache ≫ Tomcat Version 9.0.0 Update milestone1
Apache ≫ Tomcat Version 9.0.0 Update milestone10
Apache ≫ Tomcat Version 9.0.0 Update milestone11
Apache ≫ Tomcat Version 9.0.0 Update milestone12
Apache ≫ Tomcat Version 9.0.0 Update milestone13
Apache ≫ Tomcat Version 9.0.0 Update milestone14
Apache ≫ Tomcat Version 9.0.0 Update milestone15
Apache ≫ Tomcat Version 9.0.0 Update milestone16
Apache ≫ Tomcat Version 9.0.0 Update milestone17
Apache ≫ Tomcat Version 9.0.0 Update milestone18
Apache ≫ Tomcat Version 9.0.0 Update milestone19
Apache ≫ Tomcat Version 9.0.0 Update milestone2
Apache ≫ Tomcat Version 9.0.0 Update milestone20
Apache ≫ Tomcat Version 9.0.0 Update milestone21
Apache ≫ Tomcat Version 9.0.0 Update milestone22
Apache ≫ Tomcat Version 9.0.0 Update milestone23
Apache ≫ Tomcat Version 9.0.0 Update milestone24
Apache ≫ Tomcat Version 9.0.0 Update milestone25
Apache ≫ Tomcat Version 9.0.0 Update milestone26
Apache ≫ Tomcat Version 9.0.0 Update milestone27
Apache ≫ Tomcat Version 9.0.0 Update milestone3
Apache ≫ Tomcat Version 9.0.0 Update milestone4
Apache ≫ Tomcat Version 9.0.0 Update milestone5
Apache ≫ Tomcat Version 9.0.0 Update milestone6
Apache ≫ Tomcat Version 9.0.0 Update milestone7
Apache ≫ Tomcat Version 9.0.0 Update milestone8
Apache ≫ Tomcat Version 9.0.0 Update milestone9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 45.57% 0.986
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.1 2.8 2.7
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://www.oracle.com/security-alerts/cpujan2020.html
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html
https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E
https://seclists.org/bugtraq/2019/Dec/43
https://www.debian.org/security/2019/dsa-4596
https://access.redhat.com/errata/RHSA-2019:3929
https://access.redhat.com/errata/RHSA-2019:3931
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/
http://packetstormsecurity.com/files/163457/Apache-Tomcat-9.0.0.M1-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2019/May/50
Third Party Advisory
http://www.securityfocus.com/bid/108545
https://lists.apache.org/thread.html/6e6e9eacf7b28fd63d249711e9d3ccd4e0a83f556e324aee37be5a8c%40%3Cannounce.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2019/05/msg00044.html
https://security.gentoo.org/glsa/202003-43
https://security.netapp.com/advisory/ntap-20190606-0001/
https://support.f5.com/csp/article/K13184144?utm_source=f5support&amp%3Butm_medium=RSS
https://usn.ubuntu.com/4128-1/
https://usn.ubuntu.com/4128-2/
https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/