Description

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.

Remediation

References

CVE-2019-0221

Related Vulnerabilities

WordPress Plugin Developer Formatter Cross-Site Request Forgery (2012.0.1.39)

Envoy Proxy Improper Encoding or Escaping of Output Vulnerability (CVE-2024-45808)

Roundcube Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-13964)

WordPress Plugin Restricted Site Access Unspecified Vulnerability (2.0)

WordPress Plugin FreeMind WP Browser Cross-Site Request Forgery (1.2)

Severity

Medium

Classification

CVE-2019-0221 CWE-707 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities