Cross-site scripting in Apache Tomcat
Moderate severity
GitHub Reviewed
Published
May 30, 2019
to the GitHub Advisory Database
•
Updated Mar 11, 2024
Package
Affected versions
>= 9.0.0, < 9.0.17
>= 8.0.0, < 8.5.40
>= 7.0.0, < 7.0.94
Patched versions
9.0.17
8.5.40
7.0.94
Description
Published by the National Vulnerability Database
May 28, 2019
Reviewed
May 30, 2019
Published to the GitHub Advisory Database
May 30, 2019
Last updated
Mar 11, 2024
Credits
-
sunSUNQ Analyst
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
References