You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
CVE-2019-0221 - Medium Severity Vulnerability
Vulnerable Library - tomcat-embed-core-8.5.28.jar
Core Tomcat implementation
Library home page: http://tomcat.apache.org/
Path to dependency file: /sonatype-depshield-demo/pom.xml
Path to vulnerable library: /root/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/8.5.28/tomcat-embed-core-8.5.28.jar
Dependency Hierarchy:
Vulnerability Details
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
Publish Date: 2019-05-28
URL: CVE-2019-0221
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0221
Release Date: 2019-05-28
Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 8.5.40
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.1.0.RELEASE
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: