Описание
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
Меры по смягчению последствий
SSI is disabled in the default Tomcat configuration. The vulnerable printenv command is intended for debugging, and is recommended to not be enabled for a production website.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat BPM Suite 6 | tomcat | Out of support scope | ||
| Red Hat Enterprise Linux 6 | tomcat6 | Out of support scope | ||
| Red Hat Enterprise Linux 7 | tomcat | Affected | ||
| Red Hat Enterprise Linux 8 | pki-deps:10.6/pki-servlet-container | Fix deferred | ||
| Red Hat Fuse 7 | tomcat | Not affected | ||
| Red Hat JBoss BRMS 5 | jbossweb | Out of support scope | ||
| Red Hat JBoss BRMS 6 | tomcat | Out of support scope | ||
| Red Hat JBoss Data Grid 6 | jbossweb | Out of support scope | ||
| Red Hat JBoss Data Grid 7 | tomcat | Not affected | ||
| Red Hat JBoss Data Virtualization 6 | jbossweb | Out of support scope |
Показывать по
Дополнительная информация
Статус:
EPSS
5 Medium
CVSS3
Связанные уязвимости
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 ...
Уязвимость команды printenv сервера приложений Apache Tomcat, позволяющая нарушителю осуществить межсайтовую сценарную атаку
EPSS
5 Medium
CVSS3