CVE-2019-0221 Public exploit EPSS 59.2%

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user…

Apache · Apache Tomcat

Summary

The SSI printenv command in Apache Tomcat (versions 9.0.0.M1 through 9.0.0.17, 8.5.0 through 8.5.39, and 7.0.0 through 7.0.93) echoes user-provided data without escaping, leading to cross-site scripting. An attacker could exploit this only where Server Side Includes are enabled, which is not the default, and where the printenv debugging command is present in a page, which is unlikely in production.

Official description · CVE.org

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.

Breakdown

24.8 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (Exploit-DB) appeared 2 years after disclosure. No confirmed exploitation is recorded.

Disclosed28 May 2019day 0
Public exploit codeExploit-DB13 Jul 2021+2 yrs

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

3 packages in 1 ecosystem. Main package: org.apache.tomcat:tomcat.

Mavenorg.apache.tomcat:tomcatGHSA-jjpq-gp5q-8q6w

Upgrade to 9.0.109 or later

Fixes this CVE and 6 other known vulnerabilities in this package (CVE-2020-13934, CVE-2020-13935, +4).

Set the version to 9.0.109 or later in your pom.xml or build.gradle.

First fixed in 9.0.17 for CVE-2019-0221.

Affected versions, by release line

If you run	Upgrade to
9.0.0 up to 9.0.17	9.0.109first fix for this CVE: 9.0.17
8.5.0 up to 8.5.40 Still affected on this line by CVE-2025-55752 (no fix published).	8.5.82first fix for this CVE: 8.5.40
7.0.0 up to 7.0.94	7.0.105first fix for this CVE: 7.0.94

“Up to” means the second version is the fix and is not affected.

Other packages that bundle this code (2)

Forks, repackagings and products that include the affected code. Each has its own fixed version.

Mavenorg.apache.tomcat.embed:tomcat-embed-core
Affected: 9.0.0 up to 9.0.17; 8.5.0 up to 8.5.40; 7.0.0 up to 7.0.94Upgrade to 9.0.109 or later (older lines: 8.5.94, 7.0.104)
GHSA-jjpq-gp5q-8q6w
Mavenorg.apache.tomcat:tomcat-catalina
Affected: 9.0.0 up to 9.0.17; 8.5.0 up to 8.5.40; 7.0.0 up to 7.0.94Upgrade to 9.0.109 or later (older lines: 8.5.55, 7.0.104)
GHSA-jjpq-gp5q-8q6w

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

29 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2019-0473

Apache Tomcat 9.0.0.M1 - Cross-Site Scripting (XSS)EDB-50119 · webapps · multiple · 2021-07-13

, 30 Oct 2026

59.2%Top 0.89%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.11%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9911 19.8/20

Threat reports0 reports 0.0/10

Public exploit code1 Exploit-DB entry; 1 NVD exploit link; 1 nuclei template 5.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total24.8

Record

Published: 28 May 2019
Modified: 4 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

References

mailing-list 10

vdb-entry 1

vendor-advisory 10

x_refsource_MISC 5

x_refsource_CONFIRM 3

techniques