---
id: CVE-2019-0221
title: >-
  The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to
  8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is,
  therefore, vulnerable to XSS
summary: >-
  The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to
  8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is,
  therefore, vulnerable to XSS. SSI is disabled by default. The printenv command
  is inte…
severity: none
vendor: Apache
product: Apache Tomcat
affected:
  - tomcat Apache Tomcat 9.0.0.M1 to 9.0.0.17
  - tomcat 8.5.0 to 8.5.39
  - tomcat 7.0.0 to 7.0.93
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T17:28:46.161042Z'
exploitAvailable: true
published: '2019-05-28'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T17:29:08.489Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2019-0221'
references:
  - url: 'http://seclists.org/fulldisclosure/2019/May/50'
    label: 20190529 XSS in SSI printenv command - Apache Tomcat - CVE-2019-0221
  - url: 'https://lists.debian.org/debian-lts-announce/2019/05/msg00044.html'
    label: >-
      [debian-lts-announce] 20190530 [SECURITY] [DLA 1810-1] tomcat7 security
      update
  - url: 'http://www.securityfocus.com/bid/108545'
    label: '108545'
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/
    label: FEDORA-2019-1a3f878d27
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html'
    label: 'openSUSE-SU-2019:1673'
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/
    label: FEDORA-2019-d66febb5df
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html'
    label: 'openSUSE-SU-2019:1808'
  - url: 'https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html'
    label: >-
      [debian-lts-announce] 20190813 [SECURITY] [DLA 1883-1] tomcat8 security
      update
  - url: 'https://usn.ubuntu.com/4128-1/'
    label: USN-4128-1
  - url: 'https://usn.ubuntu.com/4128-2/'
    label: USN-4128-2
  - url: 'https://access.redhat.com/errata/RHSA-2019:3929'
    label: 'RHSA-2019:3929'
  - url: 'https://access.redhat.com/errata/RHSA-2019:3931'
    label: 'RHSA-2019:3931'
  - url: 'https://www.debian.org/security/2019/dsa-4596'
    label: DSA-4596
  - url: 'https://seclists.org/bugtraq/2019/Dec/43'
    label: '20191229 [SECURITY] [DSA 4596-1] tomcat8 security update'
  - url: >-
      https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E
    label: '[announce] 20200131 Apache Software Foundation Security Report: 2019'
  - url: >-
      https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E
    label: >-
      [tomcat-dev] 20200203 svn commit: r1873527 [24/30] -
      /tomcat/site/trunk/docs/
  - url: >-
      https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E
    label: >-
      [tomcat-dev] 20200203 svn commit: r1873527 [25/30] -
      /tomcat/site/trunk/docs/
  - url: >-
      https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
    label: >-
      [tomcat-dev] 20200213 svn commit: r1873980 [27/34] -
      /tomcat/site/trunk/docs/
  - url: >-
      https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E
    label: >-
      [tomcat-dev] 20200213 svn commit: r1873980 [28/34] -
      /tomcat/site/trunk/docs/
  - url: >-
      https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E
    label: >-
      [tomcat-dev] 20200213 svn commit: r1873980 [29/34] -
      /tomcat/site/trunk/docs/
  - url: 'https://security.gentoo.org/glsa/202003-43'
    label: GLSA-202003-43
  - url: 'https://www.oracle.com/security-alerts/cpuapr2020.html'
  - url: 'https://www.oracle.com/security-alerts/cpujan2020.html'
  - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html'
  - url: >-
      https://lists.apache.org/thread.html/6e6e9eacf7b28fd63d249711e9d3ccd4e0a83f556e324aee37be5a8c%40%3Cannounce.tomcat.apache.org%3E
  - url: 'https://security.netapp.com/advisory/ntap-20190606-0001/'
  - url: >-
      https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/
  - url: >-
      https://support.f5.com/csp/article/K13184144?utm_source=f5support&amp%3Butm_medium=RSS
  - url: >-
      http://packetstormsecurity.com/files/163457/Apache-Tomcat-9.0.0.M1-Cross-Site-Scripting.html
tags:
  - cve.org
  - exploit-available
epss: 0.59194
epssPercentile: 0.99119
exploits:
  exploitdb: true
  nuclei:
    - CVE-2019-0221
  checkedAt: '2026-11-05T19:31:18.363Z'
ingestedAt: '2026-11-05T19:30:42.727Z'
---

## Overview

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.

## Affected

- `tomcat Apache Tomcat 9.0.0.M1 to 9.0.0.17`
- `tomcat 8.5.0 to 8.5.39`
- `tomcat 7.0.0 to 7.0.93`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.