The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.

The version of tomcat installed on the remote host is prior to 8.5.40-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT8.5-2023-014 advisory.

  - The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes     user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The     printenv command is intended for debugging and is unlikely to be present in a production website.
    (CVE-2019-0221)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2200 advisory.

  - The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes     user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The     printenv command is intended for debugging and is unlikely to be present in a production website.
    (CVE-2019-0221)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14375-1 advisory.

  - The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes     user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The     printenv command is intended for debugging and is unlikely to be present in a production website.
    (CVE-2019-0221)

  - When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote     Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able     to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords     used to access the JMX interface. The attacker can then use these credentials to access the JMX interface     and gain complete control over the Tomcat instance. (CVE-2019-12418)

  - When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to     7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the     server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is     configured with sessionAttributeValueClassNameFilter=null (the default unless a SecurityManager is used)     or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker     knows the relative file path from the storage location used by FileStore to the file the attacker has     control over; then, using a specifically crafted request, the attacker will be able to trigger remote code     execution via deserialization of the file under their control. Note that all of conditions a) to d) must     be true for the attack to succeed. (CVE-2020-9484)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Publisher or Oracle Analytics Server 5.5 running on the remote host is 11.1.1.9.x prior to 11.1.1.9.210215, 12.2.1.3.x prior to 12.2.1.3.210405, 12.2.1.4.x prior to 12.2.1.4.210402, or 12.2.5.5.x (OAS 5.5) prior to 12.2.5.5.210331. It is, therefore, affected by multiple vulnerabilities as noted in the April 2021 Critical Patch Update advisory, including the following:

  - An unspecified vulnerability exists in the Analytics Server component of Oracle BI Enterprise Edition     subcomponent Apache Spark. An unauthenticated, remote attacker can exploit this, via HTTP, to take over     Oracle BI Enterprise Edition. (CVE-2020-9480)

  - A denial of service vulnerability exists in the BI Platform Security component of Oracle BI Enterprise     Edition subcomponent OpenSSL. An unauthenticated, remote attacker can exploit this, via HTTPS, to hang or     repeatedly crash the product. (CVE-2020-1971)

  - An unspecified vulnerability exists in the BI Platform Security component of Oracle BI Enterprise Edition     subcomponent Apache Tomcat.  An unauthenticated, remote attacker can exploit this, via HTTP, to result in     unauthorized update, insert, or delete access to some of Oracle BI accessible data, as well as     unauthorized read access to a subset of Oracle BI accessible data. (CVE-2019-0221)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-43 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache Tomcat. Please       review the CVE identifiers referenced below for details.
  Impact :

    An attacker could possibly smuggle HTTP requests or execute arbitrary       code.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0861 advisory.

  - tomcat: XSS in SSI printenv (CVE-2019-0221)

  - tomcat: local privilege escalation (CVE-2019-12418)

  - tomcat: Session fixation when using FORM authentication (CVE-2019-17563)

  - tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability (CVE-2020-1938)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several issues were discovered in the Tomcat servlet and JSP engine, which could result in session fixation attacks, information disclosure, cross-site scripting, denial of service via resource exhaustion and insecure redirects.

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The URL pattern of '' (the empty string) which exactly     maps to the context root was not correctly handled in     Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27,     8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as     part of a security constraint definition. This caused     the constraint to be ignored. It was, therefore,     possible for unauthorised users to gain access to web     application resources that should have been protected.
    Only security constraints with a URL pattern of the     empty string were affected.(CVE-2018-1304)

  - Security constraints defined by annotations of Servlets     in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27,     8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only     applied once a Servlet had been loaded. Because     security constraints defined in this way apply to the     URL pattern and any URLs below that point, it was     possible - depending on the order Servlets were loaded
    - for some security constraints not to be applied. This     could have exposed resources to users who were not     authorised to access them.(CVE-2018-1305)

  - The SSI printenv command in Apache Tomcat 9.0.0.M1 to     9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes     user provided data without escaping and is, therefore,     vulnerable to XSS. SSI is disabled by default. The     printenv command is intended for debugging and is     unlikely to be present in a production     website.(CVE-2019-0221)

  - The host name verification when using TLS with the     WebSocket client was missing. It is now enabled by     default. Versions Affected: Apache Tomcat 9.0.0.M1 to     9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35     to 7.0.88.(CVE-2018-8034)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated Red Hat JBoss Web Server 5.2.0 packages are now available for Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 5.2 serves as a replacement for Red Hat JBoss Web Server 5.1, and includes bug fixes, enhancements, and component upgrades, which are documented in the Release Notes, linked to in the References.

Security Fix(es) :

* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)

* openssl: 0-byte record padding oracle (CVE-2019-1559)

* tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199 (CVE-2019-10072)

* tomcat: XSS in SSI printenv (CVE-2019-0221)

* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The SSI printenv command in Apache Tomcat 9.0.0.M1 to     9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes     user provided data without escaping and is, therefore,     vulnerable to XSS. SSI is disabled by default. The     printenv command is intended for debugging and is     unlikely to be present in a production     website.(CVE-2019-0221)

  - When the default servlet in Apache Tomcat versions     9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to     7.0.90 returned a redirect to a directory (e.g.
    redirecting to '/foo/' when the user requested '/foo')     a specially crafted URL could be used to cause the     redirect to be generated to any URI of the attackers     choice.(CVE-2018-11784)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the Tomcat 9 SSI printenv command echoed user provided data without escaping it. An attacker could possibly use this issue to perform an XSS attack. (CVE-2019-0221)

It was discovered that Tomcat 9 did not address HTTP/2 connection window exhaustion on write while addressing CVE-2019-0199. An attacker could possibly use this issue to cause a denial of service.
(CVE-2019-10072).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The SSI printenv command in Apache Tomcat 9.0.0.M1 to     9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes     user provided data without escaping and is, therefore,     vulnerable to XSS. SSI is disabled by default. The     printenv command is intended for debugging and is     unlikely to be present in a production     website.(CVE-2019-0221)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the Tomcat 8 SSI printenv command echoed user provided data without escaping it. An attacker could possibly use this issue to perform an XSS attack. (CVE-2019-0221)

It was discovered that Tomcat 8 did not address HTTP/2 connection window exhaustion on write while addressing CVE-2019-0199. An attacker could possibly use this issue to cause a denial of service.
(CVE-2019-10072).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several minor issues have been fixed in tomcat8, a Java Servlet and JSP engine.

CVE-2016-5388

Apache Tomcat, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an 'httpoxy' issue. The 'cgi' servlet now has a 'envHttpHeaders' parameter to filter environment variables.

CVE-2018-8014

The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.

CVE-2019-0221

The SSI printenv command in Apache Tomcat echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.

For Debian 8 'Jessie', these problems have been fixed in version 8.0.14-1+deb8u15.

We recommend that you upgrade your tomcat8 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tomcat to version 9.0.21 fixes the following issues :

Security issues fixed :

  - CVE-2019-0199: Fixed a denial of service in the HTTP/2     implementation related to streams with excessive numbers     of SETTINGS frames (bsc#1131055).

  - CVE-2019-0221: Fixed a cross site scripting     vulnerability with the SSI printenv command     (bsc#1136085).

Non-security issues fixed :

  - Increase maximum number of threads and open files for     tomcat (bsc#1111966).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The SSI printenv command in Apache Tomcat echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website. (CVE-2019-0221)

The HTTP/2 implementation in Apache Tomcat accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS. (CVE-2019-0199)

The SSI printenv command in Apache Tomcat echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website. (CVE-2019-0221)

This update includes a rebase from 9.0.13 up to 9.0.21 which resolves two CVEs along with various other bugs/features :

  - rhbz#1673856 tomcat-9.0.21 is available

  - rhbz#1713279 CVE-2019-0221 tomcat: XSS in SSI printenv

  - rhbz#1693326 CVE-2019-0199 tomcat: Apache Tomcat HTTP/2     DoS

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tomcat to version 9.0.20 fixes the following issues :

Security issues fixed :

  - CVE-2019-0199: Fixed a denial of service in the HTTP/2     implementation related to streams with excessive numbers     of SETTINGS frames (bsc#1131055).

  - CVE-2019-0221: Fixed a cross site scripting     vulnerability with the SSI printenv command     (bsc#1136085).

Non-security issues fixed :

  - Increase maximum number of threads and open files for     tomcat (bsc#1111966).

This update was imported from the SUSE:SLE-15:Update update project.

Nightwatch Cybersecurity Research team identified a XSS vulnerability in tomcat7. The SSI printenv command echoes user provided data without escaping. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.

For Debian 8 'Jessie', this problem has been fixed in version 7.0.56-3+really7.0.94-1.

We recommend that you upgrade your tomcat7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tomcat installed on the remote Windows host is prior to 9.0.19. It is, therefore, affected by a remote code execution vulnerability due to a bug in the way the JRE passes command line arguments to Windows. An unauthenticated, remote attacker can exploit this to execute arbitrary commands. Additionally, it is affected by a cross-site (XSS) scripting vulnerability as the SSI printenv command echoes user provided data without proper escaping.

Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote Windows host is prior to 7.0.94. It is, therefore, affected by a remote code execution vulnerability due to a bug in the way the JRE passes command line arguments to Windows. An unauthenticated, remote attacker can exploit this to execute arbitrary commands. Additionally, it is affected by a cross-site (XSS) scripting vulnerability as the SSI printenv command echoes user provided data without proper escaping.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote Windows host is prior to 8.5.40. It is, therefore, affected by a remote code execution vulnerability due to a bug in the way the JRE passes command line arguments to Windows. An unauthenticated, remote attacker can exploit this to execute arbitrary commands. Additionally, it is affected by a cross-site (XSS) scripting vulnerability as the SSI printenv command echoes user provided data without proper escaping.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
181981	Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-014)	Nessus	Amazon Linux Local Security Checks	medium
179763	Amazon Linux 2 : tomcat (ALAS-2023-2200)	Nessus	Amazon Linux Local Security Checks	medium
150581	SUSE SLES11 Security Update : tomcat6 (SUSE-SU-2020:14375-1)	Nessus	SuSE Local Security Checks	high
148980	Oracle Business Intelligence Publisher Multiple Vulnerabilities (Apr 2021 CPU)	Nessus	Misc.	critical
134729	GLSA-202003-43 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
134668	RHEL 6 / 7 : Red Hat JBoss Web Server 3.1 Service Pack 8 (RHSA-2020:0861)	Nessus	Red Hat Local Security Checks	critical
132427	Debian DSA-4596-1 : tomcat8 - security update	Nessus	Debian Local Security Checks	critical
131853	EulerOS 2.0 SP2 : tomcat (EulerOS-SA-2019-2361)	Nessus	Huawei Local Security Checks	high
131214	RHEL 6 / 7 / 8 : JBoss Web Server (RHSA-2019:3929)	Nessus	Red Hat Local Security Checks	high
129240	EulerOS 2.0 SP3 : tomcat (EulerOS-SA-2019-2047)	Nessus	Huawei Local Security Checks	medium
129048	Ubuntu 18.04 LTS : Tomcat vulnerabilities (USN-4128-2)	Nessus	Ubuntu Local Security Checks	medium
128808	EulerOS 2.0 SP5 : tomcat (EulerOS-SA-2019-1885)	Nessus	Huawei Local Security Checks	medium
128682	Ubuntu 16.04 LTS / 18.04 LTS : Tomcat vulnerabilities (USN-4128-1)	Nessus	Ubuntu Local Security Checks	medium
128188	EulerOS 2.0 SP8 : tomcat (EulerOS-SA-2019-1819)	Nessus	Huawei Local Security Checks	medium
127865	Debian DLA-1883-1 : tomcat8 security update (httpoxy)	Nessus	Debian Local Security Checks	critical
127088	openSUSE Security Update : tomcat (openSUSE-2019-1808)	Nessus	SuSE Local Security Checks	medium
127063	Amazon Linux AMI : tomcat7 (ALAS-2019-1235)	Nessus	Amazon Linux Local Security Checks	medium
127062	Amazon Linux AMI : tomcat8 (ALAS-2019-1234)	Nessus	Amazon Linux Local Security Checks	medium
126483	Fedora 29 : 1:tomcat (2019-d66febb5df)	Nessus	Fedora Local Security Checks	medium
126373	openSUSE Security Update : tomcat (openSUSE-2019-1673)	Nessus	SuSE Local Security Checks	medium
126225	Fedora 30 : 1:tomcat (2019-1a3f878d27)	Nessus	Fedora Local Security Checks	medium
125606	Debian DLA-1810-1 : tomcat7 security update	Nessus	Debian Local Security Checks	medium
700711	Apache Tomcat 9.0.x < 9.0.19 Remote Code Execution Vulnerability (Windows)	Nessus Network Monitor	Web Servers	high
124064	Apache Tomcat 7.0.0 < 7.0.94 Remote Code Execution Vulnerability (Windows)	Nessus	Web Servers	high
124063	Apache Tomcat 8.5.0 < 8.5.40 Remote Code Execution Vulnerability (Windows)	Nessus	Web Servers	high

Detections

Analytics

CVE-2019-0221

medium

Tenable Plugins

medium

medium

high

critical

critical

critical

critical

high

high

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

high

high

high