{"id":"CVE-2019-0221","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-0221","generatedAt":"2026-10-28T21:22:52.083Z","title":"The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS.","description":"The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.","published":"2019-05-28T22:29:01.000Z","lastModified":"2026-06-17T02:08:01.000Z","status":"Modified","sourceIdentifier":"security@apache.org","cvss":{"version":"3.0","score":6.1,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["apache/tomcat"],"epss":{"score":0.59194,"percentile":0.99111,"date":"2026-10-27","history":[{"date":"2026-09-21","score":0.66484,"percentile":0.99276},{"date":"2026-09-22","score":0.45571,"percentile":0.9874},{"date":"2026-09-24","score":0.59194,"percentile":0.99085}]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2021-07-13","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":50119,"kind":"exploit","title":"Apache Tomcat 9.0.0.M1 - Cross-Site Scripting (XSS)","url":"https://www.exploit-db.com/exploits/50119","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/50119.txt","file":"exploits/multiple/webapps/50119.txt","published":"2021-07-13","added":"2021-07-13","updated":"2021-07-13","author":"Central InfoSec","type":"webapps","platform":"multiple","port":null,"verified":false,"codes":["CVE-2019-0221"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 59.2%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[{"kind":"epss","label":"EPSS jump","at":"2026-09-24T00:00:00.000Z","detail":{"to":0.59194,"from":0.45571,"percentile":0.99085},"summary":"EPSS moved from 45.6% to 59.2% probability of exploitation in the next thirty days."},{"kind":"epss","label":"EPSS jump","at":"2026-09-22T00:00:00.000Z","detail":{"to":0.45571,"from":0.66484,"percentile":0.9874},"summary":"EPSS moved from 66.5% to 45.6% probability of exploitation in the next thirty days."},{"kind":"epss","label":"EPSS jump","at":"2026-09-21T00:00:00.000Z","detail":{"to":0.66484,"from":0.45571,"percentile":0.99276},"summary":"EPSS moved from 45.6% to 66.5% probability of exploitation in the next thirty days."}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html","source":"security@apache.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html","source":"security@apache.org"},{"url":"http://packetstormsecurity.com/files/163457/Apache-Tomcat-9.0.0.M1-Cross-Site-Scripting.html","source":"security@apache.org"},{"url":"http://seclists.org/fulldisclosure/2019/May/50","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"http://www.securityfocus.com/bid/108545","source":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:3929","source":"security@apache.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:3931","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/6e6e9eacf7b28fd63d249711e9d3ccd4e0a83f556e324aee37be5a8c%40%3Cannounce.tomcat.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00044.html","source":"security@apache.org"},{"url":"https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html","source":"security@apache.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/","source":"security@apache.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/","source":"security@apache.org"},{"url":"https://seclists.org/bugtraq/2019/Dec/43","source":"security@apache.org"},{"url":"https://security.gentoo.org/glsa/202003-43","source":"security@apache.org"},{"url":"https://security.netapp.com/advisory/ntap-20190606-0001/","source":"security@apache.org"},{"url":"https://support.f5.com/csp/article/K13184144?utm_source=f5support&amp%3Butm_medium=RSS","source":"security@apache.org"},{"url":"https://usn.ubuntu.com/4128-1/","source":"security@apache.org"},{"url":"https://usn.ubuntu.com/4128-2/","source":"security@apache.org"},{"url":"https://www.debian.org/security/2019/dsa-4596","source":"security@apache.org"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","source":"security@apache.org"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","source":"security@apache.org"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","source":"security@apache.org"},{"url":"https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/","source":"security@apache.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/163457/Apache-Tomcat-9.0.0.M1-Cross-Site-Scripting.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2019/May/50","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/108545","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:3929","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:3931","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/6e6e9eacf7b28fd63d249711e9d3ccd4e0a83f556e324aee37be5a8c%40%3Cannounce.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00044.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://seclists.org/bugtraq/2019/Dec/43","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202003-43","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20190606-0001/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.f5.com/csp/article/K13184144?utm_source=f5support&amp%3Butm_medium=RSS","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4128-1/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4128-2/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2019/dsa-4596","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-0221","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}