CVE-2019-0221: Cross-site scripting in Apache Tomcat

org.apache.tomcat.embed:tomcat-embed-core Updated 02 Oct 2025

Summary

30/05/2019

Disclosed on

CVE-2019-0221

CVE

Yes i

Fix available

Moderate

Severity

6.1

CVSS Score

CVE-2019-0221: Cross-site scripting in Apache Tomcat. Affects org.apache.tomcat.embed:tomcat-embed-core across 3 version ranges.

>= 7.0.0, < 7.0.94 >= 8.0.0, < 8.5.40 >= 9.0.0, < 9.0.17

Fixed in 7.0.94, 8.5.40 or 9.0.17, depending on the release line you run. How to fix ↓

Also tracked for

tomcat9 · Debian:11

The same CVE-2019-0221 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. The Apache Tomcat Embed Core package is a Maven package that allows embedding Tomcat into other applications. This vulnerability affects versions 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39, and 7.0.0 to 7.0.93 of the Tomcat Embed Core package. The SSI printenv command in these versions of Tomcat echoes user-provided data without proper escaping, making it vulnerable to cross-site scripting (XSS) attacks. Although SSI is disabled by default, the printenv command, intended for debugging purposes, can still be present in a production website.

Vulnerability Detail

The vulnerability (CVE-2019-0221) in Apache Tomcat allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser. By injecting malicious code through the SSI printenv command, an attacker can exploit this vulnerability to steal sensitive information, perform actions on behalf of the victim, or manipulate the content of the affected web page. This vulnerability has a CVSS score of 6.1, indicating a moderate severity level. It is classified under CWE-79, which is the Common Weakness Enumeration category for cross-site scripting vulnerabilities.

How To Fix

Latest published version: 11.0.27 as of 23 Oct 2026

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

>= 7.0.0, < 7.0.94 7.0.94
>= 8.0.0, < 8.5.40 8.5.40
>= 9.0.0, < 9.0.17 9.0.17

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

If upgrading to a fixed version is not immediately possible, a temporary workaround is to disable the SSI printenv command in the Tomcat configuration. This can be done by removing or commenting out the relevant configuration entry in the Tomcat server configuration file. By disabling the printenv command, the XSS vulnerability will be mitigated. However, it is still recommended to upgrade to a fixed version as soon as possible.

Conclusion

The XSS vulnerability in Apache Tomcat's SSI printenv command can be mitigated by upgrading to the fixed versions of the Apache Tomcat Embed Core package. If immediate upgrading is not possible, disabling the printenv command in the Tomcat configuration can serve as a temporary workaround. It is important to address this vulnerability promptly to prevent potential exploitation. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.apache.tomcat.embed:tomcat-embed-core →

FAQ

What is Apache Tomcat?

Apache Tomcat is an open-source web server and servlet container used for hosting Java-based web applications.

What is the Apache Tomcat Embed Core package?

The Apache Tomcat Embed Core package is a Maven package that allows embedding Tomcat into other applications.

What is cross-site scripting (XSS)?

Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.

How can this vulnerability be exploited?

This vulnerability can be exploited by injecting malicious code through the SSI printenv command in Apache Tomcat, which can then execute arbitrary JavaScript code in the victim's browser.