CVE-2023-36479 (GCVE-0-2023-36479)

Vulnerability from cvelistv5 – Published: 2023-09-15 18:37 – Updated: 2025-06-18 14:41
VLAI
Title
Jetty vulnerable to errant command quoting in CGI Servlet
Summary
Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.
Severity
3.5 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-149 - Improper Neutralization of Quoting Syntax
Assigner
References
Impacted products
Vendor Product Version
eclipse jetty.project Affected: >= 9.0.0, <= 9.4.51
Affected: >= 10.0.0, <= 10.0.15
Affected: >= 11.0.0, <= 11.0.15
Affected: <= 12.0.0-beta1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:45:57.116Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j"
          },
          {
            "name": "https://github.com/eclipse/jetty.project/pull/9516",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/eclipse/jetty.project/pull/9516"
          },
          {
            "name": "https://github.com/eclipse/jetty.project/pull/9888",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/eclipse/jetty.project/pull/9888"
          },
          {
            "name": "https://github.com/eclipse/jetty.project/pull/9889",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/eclipse/jetty.project/pull/9889"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5507"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-36479",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-25T15:04:27.724025Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-18T14:41:11.113Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jetty.project",
          "vendor": "eclipse",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c= 9.4.51"
            },
            {
              "status": "affected",
              "version": "\u003e= 10.0.0, \u003c= 10.0.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 11.0.0, \u003c= 11.0.15"
            },
            {
              "status": "affected",
              "version": "\u003c= 12.0.0-beta1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-149",
              "description": "CWE-149: Improper Neutralization of Quoting Syntax",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-30T14:06:17.561Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j"
        },
        {
          "name": "https://github.com/eclipse/jetty.project/pull/9516",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/eclipse/jetty.project/pull/9516"
        },
        {
          "name": "https://github.com/eclipse/jetty.project/pull/9888",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/eclipse/jetty.project/pull/9888"
        },
        {
          "name": "https://github.com/eclipse/jetty.project/pull/9889",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/eclipse/jetty.project/pull/9889"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5507"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html"
        }
      ],
      "source": {
        "advisory": "GHSA-3gh6-v5v9-6v9j",
        "discovery": "UNKNOWN"
      },
      "title": "Jetty vulnerable to errant command quoting in CGI Servlet"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-36479",
    "datePublished": "2023-09-15T18:37:35.948Z",
    "dateReserved": "2023-06-21T18:50:41.704Z",
    "dateUpdated": "2025-06-18T14:41:11.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-36479",
      "date": "2026-08-10",
      "epss": "0.01006",
      "percentile": "0.59755"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"9.0.0\", \"versionEndExcluding\": \"9.4.52\", \"matchCriteriaId\": \"64EE3E5D-9A4F-4C6A-B723-101CF69F89F7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"10.0.0\", \"versionEndExcluding\": \"10.0.16\", \"matchCriteriaId\": \"1D15B5CF-CDFA-4303-8A9F-CF2FAD8E10CC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"11.0.0\", \"versionEndExcluding\": \"11.0.16\", \"matchCriteriaId\": \"9153C468-135C-49C4-B33B-1828E37AF483\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:eclipse:jetty:12.0.0:alpha1:*:*:*:*:*:*\", \"matchCriteriaId\": \"CA07CE23-17D8-4EFB-A6A2-97CCB8FF8461\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:eclipse:jetty:12.0.0:alpha2:*:*:*:*:*:*\", \"matchCriteriaId\": \"9A862281-65C6-47DC-9A13-521B9187C7CD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:eclipse:jetty:12.0.0:alpha3:*:*:*:*:*:*\", \"matchCriteriaId\": \"4B999249-2A88-4270-8401-07CF57157D23\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:eclipse:jetty:12.0.0:beta0:*:*:*:*:*:*\", \"matchCriteriaId\": \"C591F4A5-8A66-4A08-B969-C4264A98C7CF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:eclipse:jetty:12.0.0:beta1:*:*:*:*:*:*\", \"matchCriteriaId\": \"9B9C2A15-1AC2-4DFA-849E-63657784FA3D\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FA6FEEC2-9F11-4643-8827-749718254FED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"46D69DCC-AE4D-4EA5-861C-D60951444C6C\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.\\n\"}, {\"lang\": \"es\", \"value\": \"Eclipse Jetty Canonical Repository es el repositorio can\\u00f3nico para el proyecto Jetty. Los usuarios de CgiServlet con una estructura de comando muy espec\\u00edfica pueden ejecutar el comando incorrecto. Si un usuario env\\u00eda una solicitud a un servlet org.eclipse.jetty.servlets.CGI para un binario con un espacio en su nombre, el servlet escapar\\u00e1 del comando envolvi\\u00e9ndolo entre comillas. Este comando empaquetado, m\\u00e1s un prefijo de comando opcional, se ejecutar\\u00e1 mediante una llamada a Runtime.exec. Si el nombre binario original proporcionado por el usuario contiene una comilla seguida de un espacio, la l\\u00ednea de comando resultante contendr\\u00e1 varios tokens en lugar de uno. Este problema se solucion\\u00f3 en las versiones 9.4.52, 10.0.16, 11.0.16 y 12.0.0-beta2.\"}]",
      "id": "CVE-2023-36479",
      "lastModified": "2024-11-21T08:09:47.847",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N\", \"baseScore\": 3.5, \"baseSeverity\": \"LOW\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 1.4}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\", \"baseScore\": 4.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 1.4}]}",
      "published": "2023-09-15T19:15:08.387",
      "references": "[{\"url\": \"https://github.com/eclipse/jetty.project/pull/9516\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/eclipse/jetty.project/pull/9888\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/eclipse/jetty.project/pull/9889\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Exploit\", \"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://www.debian.org/security/2023/dsa-5507\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/eclipse/jetty.project/pull/9516\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/eclipse/jetty.project/pull/9888\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/eclipse/jetty.project/pull/9889\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://www.debian.org/security/2023/dsa-5507\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-149\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-36479\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2023-09-15T19:15:08.387\",\"lastModified\":\"2026-06-17T06:06:21.390\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.\"},{\"lang\":\"es\",\"value\":\"Eclipse Jetty Canonical Repository es el repositorio can\u00f3nico para el proyecto Jetty. Los usuarios de CgiServlet con una estructura de comando muy espec\u00edfica pueden ejecutar el comando incorrecto. Si un usuario env\u00eda una solicitud a un servlet org.eclipse.jetty.servlets.CGI para un binario con un espacio en su nombre, el servlet escapar\u00e1 del comando envolvi\u00e9ndolo entre comillas. Este comando empaquetado, m\u00e1s un prefijo de comando opcional, se ejecutar\u00e1 mediante una llamada a Runtime.exec. Si el nombre binario original proporcionado por el usuario contiene una comilla seguida de un espacio, la l\u00ednea de comando resultante contendr\u00e1 varios tokens en lugar de uno. Este problema se solucion\u00f3 en las versiones 9.4.52, 10.0.16, 11.0.16 y 12.0.0-beta2.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"eclipse\",\"product\":\"jetty.project\",\"versions\":[{\"version\":\"\u003e= 9.0.0, \u003c= 9.4.51\",\"status\":\"affected\"},{\"version\":\"\u003e= 10.0.0, \u003c= 10.0.15\",\"status\":\"affected\"},{\"version\":\"\u003e= 11.0.0, \u003c= 11.0.15\",\"status\":\"affected\"},{\"version\":\"\u003c= 12.0.0-beta1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N\",\"baseScore\":3.5,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":3.1,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-25T15:04:27.724025Z\",\"id\":\"CVE-2023-36479\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-149\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0.0\",\"versionEndExcluding\":\"9.4.52\",\"matchCriteriaId\":\"64EE3E5D-9A4F-4C6A-B723-101CF69F89F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndExcluding\":\"10.0.16\",\"matchCriteriaId\":\"1D15B5CF-CDFA-4303-8A9F-CF2FAD8E10CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.0.0\",\"versionEndExcluding\":\"11.0.16\",\"matchCriteriaId\":\"9153C468-135C-49C4-B33B-1828E37AF483\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:12.0.0:alpha1:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA07CE23-17D8-4EFB-A6A2-97CCB8FF8461\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:12.0.0:alpha2:*:*:*:*:*:*\",\"matchCriteriaId\":\"9A862281-65C6-47DC-9A13-521B9187C7CD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:12.0.0:alpha3:*:*:*:*:*:*\",\"matchCriteriaId\":\"4B999249-2A88-4270-8401-07CF57157D23\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:12.0.0:beta0:*:*:*:*:*:*\",\"matchCriteriaId\":\"C591F4A5-8A66-4A08-B969-C4264A98C7CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eclipse:jetty:12.0.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"9B9C2A15-1AC2-4DFA-849E-63657784FA3D\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"46D69DCC-AE4D-4EA5-861C-D60951444C6C\"}]}]}],\"references\":[{\"url\":\"https://github.com/eclipse/jetty.project/pull/9516\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/eclipse/jetty.project/pull/9888\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/eclipse/jetty.project/pull/9889\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2023/dsa-5507\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/eclipse/jetty.project/pull/9516\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/eclipse/jetty.project/pull/9888\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/eclipse/jetty.project/pull/9889\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2023/dsa-5507\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:08:41+00:00",
      "cve": "CVE-2023-36479",
      "id": "CVE-2023-36479",
      "initial_release_date": "2023-09-19T00:00:00+00:00",
      "product_status:fixed": "25",
      "product_status:known_affected": "43",
      "product_status:known_not_affected": "1952",
      "product_status:under_investigation": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "jetty: Improper addition of quotation marks to user inputs in CgiServlet",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-36479.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-08-08T23:33:25Z",
      "cve": "CVE-2023-36479",
      "id": "CVE-2023-36479",
      "initial_release_date": "2023-09-19T01:56:28Z",
      "product_status:known_affected": "8",
      "product_status:recommended": "357",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-36479",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-36479.json",
      "version": "15"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j\", \"name\": \"https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/eclipse/jetty.project/pull/9516\", \"name\": \"https://github.com/eclipse/jetty.project/pull/9516\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/eclipse/jetty.project/pull/9888\", \"name\": \"https://github.com/eclipse/jetty.project/pull/9888\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/eclipse/jetty.project/pull/9889\", \"name\": \"https://github.com/eclipse/jetty.project/pull/9889\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://www.debian.org/security/2023/dsa-5507\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T16:45:57.116Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-36479\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-25T15:04:27.724025Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-25T15:04:33.103Z\"}}], \"cna\": {\"title\": \"Jetty vulnerable to errant command quoting in CGI Servlet\", \"source\": {\"advisory\": \"GHSA-3gh6-v5v9-6v9j\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 3.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"eclipse\", \"product\": \"jetty.project\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 9.0.0, \u003c= 9.4.51\"}, {\"status\": \"affected\", \"version\": \"\u003e= 10.0.0, \u003c= 10.0.15\"}, {\"status\": \"affected\", \"version\": \"\u003e= 11.0.0, \u003c= 11.0.15\"}, {\"status\": \"affected\", \"version\": \"\u003c= 12.0.0-beta1\"}]}], \"references\": [{\"url\": \"https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j\", \"name\": \"https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/eclipse/jetty.project/pull/9516\", \"name\": \"https://github.com/eclipse/jetty.project/pull/9516\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/eclipse/jetty.project/pull/9888\", \"name\": \"https://github.com/eclipse/jetty.project/pull/9888\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/eclipse/jetty.project/pull/9889\", \"name\": \"https://github.com/eclipse/jetty.project/pull/9889\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://www.debian.org/security/2023/dsa-5507\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-149\", \"description\": \"CWE-149: Improper Neutralization of Quoting Syntax\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2023-09-30T14:06:17.561Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-36479\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-06-18T14:41:11.113Z\", \"dateReserved\": \"2023-06-21T18:50:41.704Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2023-09-15T18:37:35.948Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.