{"action":"Upgrade tomcat9 to 9.0.16-4 or later.","affected":[{"fixed":"9.0.16-4","introduced":"0"}],"component":"tomcat9","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["9.0.16-4"],"id":"tcs_01M5NDKGFX737Q5AC8V89PVFRG","modified_at":"2026-09-21T07:00:04.149984762Z","published_at":"2019-05-28T22:29:00.563Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2019-0221","https://security-tracker.debian.org/tracker/CVE-2019-0221"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2019-0221","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2019-0221"}],"summary":"The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by"}