CVE-2019-0221

Imagine a website that prints back what a visitor types, but without escaping “special characters.” With this flaw, an attacker can craft input that turns into a script, so when another person loads the affected page, their browser may run the attacker’s code. That can lead to things like stealing session tokens or showing altered content—because it runs inside the same website.

This matters if you run Apache Tomcat in the affected version ranges (7.0.0–7.0.93, 8.5.0–8.5.39, 9.0.0.M1–9.0.0.17) and your setup uses or exposes SSI with the “printenv” command. It’s not automatically a risk for every Tomcat install; the issue is specifically tied to SSI “printenv” being enabled/reachable. A practical reachability gate is whether an attacker can access the SSI feature/endpoint in your application (and trigger it via a normal browser request).

This should be treated as a priority for patching because there is a public exploit available for the issue and press attention is rising. While this is rated AMBER (medium), attackers can use it to run scripts in users’ browsers when SSI “printenv” is reachable. Fixing it quickly reduces the chance of a real-world XSS incident.

1. Confirm exposure (quick checks)

   • Identify your exact Apache Tomcat version (from your deployment/package).
   • Determine whether SSI is enabled and whether the “printenv” command is in use or reachable from your site (for example, via SSI-enabled pages/servlets/config).

2. Determine if you’re within the affected ranges

   • If you are on:
     • 9.0.0.M1 to 9.0.0.17, or
     • 8.5.0 to 8.5.39, or
     • 7.0.0 to 7.0.93,
       then this is in-scope when SSI “printenv” is reachable.

3. Upgrade to a fixed version (pick the line you’re on)

   • Tomcat 9: upgrade to 9.0.17
   • Tomcat 8.5: upgrade to 8.5.40
   • Tomcat 7: upgrade to 7.0.94
     (If you’re using Tomcat embedded components, upgrade the corresponding embed artifacts to the same fixed version.)

4. Validate after the upgrade

   • In a staging environment, try the same kind of input that could previously be reflected by SSI “printenv,” and confirm the output is not executable script (it should be safely rendered).

5. If you cannot patch immediately (temporary mitigation)

   • Reduce exposure by disabling SSI (or at least ensuring SSI “printenv” is not reachable/used) so attackers cannot reach the vulnerable behavior.
   • Treat any SSI-enabled content as untrusted until the fix is applied.

6. Monitor

   • After changes, watch for abnormal browser-side errors and any suspicious request patterns to SSI-enabled paths.

CISA KEV

• KEV status: not listed in CISA KEV, so there’s no mandated CISA-driven due date from the provided findings.

Severity is medium (CVSS 6.1) with CWE-79 (cross-site scripting). The weakness is improper output handling: the SSI printenv command in Apache Tomcat echoes user-provided data without escaping, allowing injected script to be interpreted by a victim’s browser. The attack vector is through a web request that reaches the SSI “printenv” behavior (user interaction is required as reflected in the rating). Exploitation status: there is at least one public exploit/weaponization available, but no CISA KEV listing was found in the provided findings. EPSS was predicted at 45.6% with a flat trend (not a confirmation of real-world exploitation). PULSE indicates rising press attention, which supports the need to act but is not the same as KEV-confirmed exploitation. Recommended fixed versions from the findings: 9.0.17 (tomcat and tomcat-catalina and tomcat-embed-core line), 8.5.40, and 7.0.94 depending on your Tomcat major/minor line.