{"id":"CVE-2019-0221","title":"The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS","summary":"The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is inte…","severity":"none","vendor":"Apache","product":"Apache Tomcat","affected":["tomcat Apache Tomcat 9.0.0.M1 to 9.0.0.17","tomcat 8.5.0 to 8.5.39","tomcat 7.0.0 to 7.0.93"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-02T17:28:46.161042Z"},"exploitAvailable":true,"published":"2019-05-28","updated":"2026-11-02","sourceUpdated":"2026-11-02T17:29:08.489Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2019-0221","references":[{"url":"http://seclists.org/fulldisclosure/2019/May/50","label":"20190529 XSS in SSI printenv command - Apache Tomcat - CVE-2019-0221"},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00044.html","label":"[debian-lts-announce] 20190530 [SECURITY] [DLA 1810-1] tomcat7 security update"},{"url":"http://www.securityfocus.com/bid/108545","label":"108545"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/","label":"FEDORA-2019-1a3f878d27"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html","label":"openSUSE-SU-2019:1673"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/","label":"FEDORA-2019-d66febb5df"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html","label":"openSUSE-SU-2019:1808"},{"url":"https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html","label":"[debian-lts-announce] 20190813 [SECURITY] [DLA 1883-1] tomcat8 security update"},{"url":"https://usn.ubuntu.com/4128-1/","label":"USN-4128-1"},{"url":"https://usn.ubuntu.com/4128-2/","label":"USN-4128-2"},{"url":"https://access.redhat.com/errata/RHSA-2019:3929","label":"RHSA-2019:3929"},{"url":"https://access.redhat.com/errata/RHSA-2019:3931","label":"RHSA-2019:3931"},{"url":"https://www.debian.org/security/2019/dsa-4596","label":"DSA-4596"},{"url":"https://seclists.org/bugtraq/2019/Dec/43","label":"20191229 [SECURITY] [DSA 4596-1] tomcat8 security update"},{"url":"https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","label":"[announce] 20200131 Apache Software Foundation Security Report: 2019"},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","label":"[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/"},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","label":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/"},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","label":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/"},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","label":"[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/"},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","label":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/"},{"url":"https://security.gentoo.org/glsa/202003-43","label":"GLSA-202003-43"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html"},{"url":"https://lists.apache.org/thread.html/6e6e9eacf7b28fd63d249711e9d3ccd4e0a83f556e324aee37be5a8c%40%3Cannounce.tomcat.apache.org%3E"},{"url":"https://security.netapp.com/advisory/ntap-20190606-0001/"},{"url":"https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/"},{"url":"https://support.f5.com/csp/article/K13184144?utm_source=f5support&amp%3Butm_medium=RSS"},{"url":"http://packetstormsecurity.com/files/163457/Apache-Tomcat-9.0.0.M1-Cross-Site-Scripting.html"}],"tags":["cve.org","exploit-available"],"epss":0.59194,"epssPercentile":0.99119,"exploits":{"exploitdb":true,"nuclei":["CVE-2019-0221"],"checkedAt":"2026-11-05T19:31:18.363Z"},"ingestedAt":"2026-11-05T19:30:42.727Z","slug":"CVE-2019-0221","body":"## Overview\n\nThe SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.\n\n## Affected\n\n- `tomcat Apache Tomcat 9.0.0.M1 to 9.0.0.17`\n- `tomcat 8.5.0 to 8.5.39`\n- `tomcat 7.0.0 to 7.0.93`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":27,"depthScoreParts":{"impact":2.8,"likelihood":11.8,"exploitation":12,"ransomware":0},"changes":[]}