CVE-2019-0221: Apache Tomcat SSI printenv command XSS via unescaped output

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

medium priorityCVSS 6.1 and high EPSS indicate meaningful risk, but the flaw requires SSI to be enabled and the debugging printenv command to be present, which is uncommon in production.

What it is

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user-supplied data without escaping, allowing reflected cross-site scripting. SSI is disabled by default and printenv is a debugging command unlikely to exist on production sites, so exposure is limited to deployments that explicitly enable SSI and use printenv.

Impact

An attacker who can get a victim to load a crafted request against a page using the printenv SSI command can execute script in the victim's browser session, enabling session theft or page manipulation in that origin.

Attack surface

Reached over the network via HTTP requests to a Tomcat-hosted page that uses the SSI printenv command; no authentication is required, but the victim must be induced to click a crafted link or load attacker-controlled content (UI:R).

Exploitation

Not listed in CISA KEV and no ransomware association is documented; EPSS is high (0.45571, ~98.7th percentile), and references include a Packet Storm advisory and full-disclosure post, but no confirmed in-the-wild exploitation is stated.

What to do

• Upgrade Tomcat to a release above 9.0.0.17, 8.5.39 or 7.0.93 (or the fixed version noted in vendor advisories).
• Keep SSI disabled unless a documented business need exists; if enabled, remove or avoid the printenv command in production pages.
• Apply distribution vendor patches (Red Hat, Debian, Ubuntu, SUSE, Fedora, Gentoo) where Tomcat is packaged.
• Encode or validate any user-supplied data passed into SSI directives if SSI must remain enabled.

Detection

• Search Tomcat web content and configuration for SSI directives using printenv, and confirm whether SSI is enabled in production.
• Monitor web logs for requests containing SSI or printenv-related parameters and unusual script payloads in query strings.
• Review deployed Tomcat versions against the affected ranges to identify unpatched instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.