6.1

CVE-2019-0221

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.

Data is provided by the National Vulnerability Database (NVD)
Apache ≫ Tomcat Version >= 7.0.0 <= 7.0.93
Apache ≫ Tomcat Version >= 8.5.0 <= 8.5.39
Apache ≫ Tomcat Version >= 9.0.1 <= 9.0.17
Apache ≫ Tomcat Version9.0.0 Updatemilestone1
Apache ≫ Tomcat Version9.0.0 Updatemilestone10
Apache ≫ Tomcat Version9.0.0 Updatemilestone11
Apache ≫ Tomcat Version9.0.0 Updatemilestone12
Apache ≫ Tomcat Version9.0.0 Updatemilestone13
Apache ≫ Tomcat Version9.0.0 Updatemilestone14
Apache ≫ Tomcat Version9.0.0 Updatemilestone15
Apache ≫ Tomcat Version9.0.0 Updatemilestone16
Apache ≫ Tomcat Version9.0.0 Updatemilestone17
Apache ≫ Tomcat Version9.0.0 Updatemilestone18
Apache ≫ Tomcat Version9.0.0 Updatemilestone19
Apache ≫ Tomcat Version9.0.0 Updatemilestone2
Apache ≫ Tomcat Version9.0.0 Updatemilestone20
Apache ≫ Tomcat Version9.0.0 Updatemilestone21
Apache ≫ Tomcat Version9.0.0 Updatemilestone22
Apache ≫ Tomcat Version9.0.0 Updatemilestone23
Apache ≫ Tomcat Version9.0.0 Updatemilestone24
Apache ≫ Tomcat Version9.0.0 Updatemilestone25
Apache ≫ Tomcat Version9.0.0 Updatemilestone26
Apache ≫ Tomcat Version9.0.0 Updatemilestone27
Apache ≫ Tomcat Version9.0.0 Updatemilestone3
Apache ≫ Tomcat Version9.0.0 Updatemilestone4
Apache ≫ Tomcat Version9.0.0 Updatemilestone5
Apache ≫ Tomcat Version9.0.0 Updatemilestone6
Apache ≫ Tomcat Version9.0.0 Updatemilestone7
Apache ≫ Tomcat Version9.0.0 Updatemilestone8
Apache ≫ Tomcat Version9.0.0 Updatemilestone9
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 12.66% 0.937
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.