Debian/tomcat9: medium 6.1
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by
Action: Upgrade tomcat9 to 9.0.16-4 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 9.0.16-4 | - |
Fixed versions
| 9.0.16-4 |
Sources
published · modified · JSON