Summary

Security Advisory ID : BSA-2020-1045

Component : Apache Tomcat

Revision : 1.0: Final

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.

Affected Products

No Brocade Fibre Channel Products from Broadcom are currently known to be affected by this vulnerability.

Revision History