{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-02T05:56:11.138","vulnerabilities":[{"cve":{"id":"CVE-2019-0221","sourceIdentifier":"security@apache.org","published":"2019-05-28T22:29:00.563","lastModified":"2024-11-21T04:16:31.373","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website."},{"lang":"es","value":"El comando printenv de SSI en Apache Tomcat versión 9.0.0.M1 hasta 9.0.0.17, versión 8.5.0 hasta 8.5.39 y versión 7.0.0 hasta 7.0.93, hace eco de los datos suministrados por el usuario sin escapar, y en consecuencia, es vulnerable a XSS. SSI está deshabilitado por defecto. El comando printenv está destinado a la depuración y es poco probable que esté presente en un sitio web de producción."}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndIncluding":"7.0.93","matchCriteriaId":"91627C43-9E36-447C-AC2B-A63F1CDB29C7"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*","versionStartIncluding":"8.5.0","versionEndIncluding":"8.5.39","matchCriteriaId":"4064056C-7B06-49BA-A4D2-0C228060B116"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.1","versionEndIncluding":"9.0.17","matchCriteriaId":"4A70BBA8-1F21-4CD6-822A-17ECC4710065"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*","matchCriteriaId":"9D0689FE-4BC0-4F53-8C79-34B21F9B86C2"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*","matchCriteriaId":"89B129B2-FB6F-4EF9-BF12-E589A87996CF"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*","matchCriteriaId":"8B6787B6-54A8-475E-BA1C-AB99334B2535"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*","matchCriteriaId":"EABB6FBC-7486-44D5-A6AD-FFF1D3F677E1"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*","matchCriteriaId":"E10C03BC-EE6B-45B2-83AE-9E8DFB58D7DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*","matchCriteriaId":"8A6DA0BE-908C-4DA8-A191-A0113235E99A"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*","matchCriteriaId":"39029C72-28B4-46A4-BFF5-EC822CFB2A4C"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*","matchCriteriaId":"1A2E05A3-014F-4C4D-81E5-88E725FBD6AD"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*","matchCriteriaId":"166C533C-0833-41D5-99B6-17A4FAB3CAF0"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*","matchCriteriaId":"D3768C60-21FA-4B92-B98C-C3A2602D1BC4"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*","matchCriteriaId":"DDD510FA-A2E4-4BAF-A0DE-F4E5777E9325"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*","matchCriteriaId":"9F542E12-6BA8-4504-A494-DA83E7E19BD5"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*","matchCriteriaId":"C2409CC7-6A85-4A66-A457-0D62B9895DC1"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*","matchCriteriaId":"B392A7E5-4455-4B1C-8FAC-AE6DDC70689E"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*","matchCriteriaId":"EF411DDA-2601-449A-9046-D250419A0E1A"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*","matchCriteriaId":"D7D8F2F4-AFE2-47EA-A3FD-79B54324DE02"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*","matchCriteriaId":"1B4FBF97-DE16-4E5E-BE19-471E01818D40"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*","matchCriteriaId":"3B266B1E-24B5-47EE-A421-E0E3CC0C7471"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*","matchCriteriaId":"29614C3A-6FB3-41C7-B56E-9CC3F45B04F0"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*","matchCriteriaId":"C6AB156C-8FF6-4727-AF75-590D0DCB3F9D"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*","matchCriteriaId":"C0C5F004-F7D8-45DB-B173-351C50B0EC16"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*","matchCriteriaId":"D1902D2E-1896-4D3D-9E1C-3A675255072C"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*","matchCriteriaId":"49AAF4DF-F61D-47A8-8788-A21E317A145D"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*","matchCriteriaId":"454211D0-60A2-4661-AECA-4C0121413FEB"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*","matchCriteriaId":"0686F977-889F-4960-8E0B-7784B73A7F2D"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*","matchCriteriaId":"558703AE-DB5E-4DFF-B497-C36694DD7B24"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*","matchCriteriaId":"ED6273F2-1165-47A4-8DD7-9E9B2472941B"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html","source":"security@apache.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html","source":"security@apache.org"},{"url":"http://packetstormsecurity.com/files/163457/Apache-Tomcat-9.0.0.M1-Cross-Site-Scripting.html","source":"security@apache.org"},{"url":"http://seclists.org/fulldisclosure/2019/May/50","source":"security@apache.org","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/108545","source":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:3929","source":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:3931","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/6e6e9eacf7b28fd63d249711e9d3ccd4e0a83f556e324aee37be5a8c%40%3Cannounce.tomcat.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00044.html","source":"security@apache.org"},{"url":"https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html","source":"security@apache.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/","source":"security@apache.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/","source":"security@apache.org"},{"url":"https://seclists.org/bugtraq/2019/Dec/43","source":"security@apache.org"},{"url":"https://security.gentoo.org/glsa/202003-43","source":"security@apache.org"},{"url":"https://security.netapp.com/advisory/ntap-20190606-0001/","source":"security@apache.org"},{"url":"https://support.f5.com/csp/article/K13184144?utm_source=f5support&amp%3Butm_medium=RSS","source":"security@apache.org"},{"url":"https://usn.ubuntu.com/4128-1/","source":"security@apache.org"},{"url":"https://usn.ubuntu.com/4128-2/","source":"security@apache.org"},{"url":"https://www.debian.org/security/2019/dsa-4596","source":"security@apache.org"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","source":"security@apache.org"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","source":"security@apache.org"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","source":"security@apache.org"},{"url":"https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/","source":"security@apache.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/163457/Apache-Tomcat-9.0.0.M1-Cross-Site-Scripting.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2019/May/50","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/108545","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:3929","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:3931","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/6e6e9eacf7b28fd63d249711e9d3ccd4e0a83f556e324aee37be5a8c%40%3Cannounce.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00044.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://seclists.org/bugtraq/2019/Dec/43","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202003-43","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20190606-0001/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.f5.com/csp/article/K13184144?utm_source=f5support&amp%3Butm_medium=RSS","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4128-1/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4128-2/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2019/dsa-4596","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}