FKIE_CVE-2023-36479

Vulnerability from fkie_nvd - Published: 2023-09-15 19:15 - Updated: 2025-05-27 21:20
Severity ?
3.5 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
3.1 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Summary
Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.
References
security-advisories@github.comhttps://github.com/eclipse/jetty.project/pull/9516Patch
security-advisories@github.comhttps://github.com/eclipse/jetty.project/pull/9888Patch
security-advisories@github.comhttps://github.com/eclipse/jetty.project/pull/9889Patch
security-advisories@github.comhttps://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9jExploit, Patch, Vendor Advisory
security-advisories@github.comhttps://lists.debian.org/debian-lts-announce/2023/09/msg00039.htmlMailing List, Third Party Advisory
security-advisories@github.comhttps://www.debian.org/security/2023/dsa-5507Third Party Advisory, Mailing List
af854a3a-2127-422b-91ae-364da2661108https://github.com/eclipse/jetty.project/pull/9516Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/eclipse/jetty.project/pull/9888Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/eclipse/jetty.project/pull/9889Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9jExploit, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2023/09/msg00039.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2023/dsa-5507Third Party Advisory, Mailing List
Impacted products
Vendor Product Version
eclipse jetty *
eclipse jetty *
eclipse jetty *
eclipse jetty 12.0.0
eclipse jetty 12.0.0
eclipse jetty 12.0.0
eclipse jetty 12.0.0
eclipse jetty 12.0.0
debian debian_linux 10.0
debian debian_linux 11.0
debian debian_linux 12.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "64EE3E5D-9A4F-4C6A-B723-101CF69F89F7",
              "versionEndExcluding": "9.4.52",
              "versionStartIncluding": "9.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D15B5CF-CDFA-4303-8A9F-CF2FAD8E10CC",
              "versionEndExcluding": "10.0.16",
              "versionStartIncluding": "10.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9153C468-135C-49C4-B33B-1828E37AF483",
              "versionEndExcluding": "11.0.16",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:alpha1:*:*:*:*:*:*",
              "matchCriteriaId": "CA07CE23-17D8-4EFB-A6A2-97CCB8FF8461",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:alpha2:*:*:*:*:*:*",
              "matchCriteriaId": "9A862281-65C6-47DC-9A13-521B9187C7CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:alpha3:*:*:*:*:*:*",
              "matchCriteriaId": "4B999249-2A88-4270-8401-07CF57157D23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:beta0:*:*:*:*:*:*",
              "matchCriteriaId": "C591F4A5-8A66-4A08-B969-C4264A98C7CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "9B9C2A15-1AC2-4DFA-849E-63657784FA3D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2."
    },
    {
      "lang": "es",
      "value": "Eclipse Jetty Canonical Repository es el repositorio can\u00f3nico para el proyecto Jetty. Los usuarios de CgiServlet con una estructura de comando muy espec\u00edfica pueden ejecutar el comando incorrecto. Si un usuario env\u00eda una solicitud a un servlet org.eclipse.jetty.servlets.CGI para un binario con un espacio en su nombre, el servlet escapar\u00e1 del comando envolvi\u00e9ndolo entre comillas. Este comando empaquetado, m\u00e1s un prefijo de comando opcional, se ejecutar\u00e1 mediante una llamada a Runtime.exec. Si el nombre binario original proporcionado por el usuario contiene una comilla seguida de un espacio, la l\u00ednea de comando resultante contendr\u00e1 varios tokens en lugar de uno. Este problema se solucion\u00f3 en las versiones 9.4.52, 10.0.16, 11.0.16 y 12.0.0-beta2."
    }
  ],
  "id": "CVE-2023-36479",
  "lastModified": "2025-05-27T21:20:37.697",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.1,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-09-15T19:15:08.387",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/eclipse/jetty.project/pull/9516"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/eclipse/jetty.project/pull/9888"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/eclipse/jetty.project/pull/9889"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory",
        "Mailing List"
      ],
      "url": "https://www.debian.org/security/2023/dsa-5507"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/eclipse/jetty.project/pull/9516"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/eclipse/jetty.project/pull/9888"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/eclipse/jetty.project/pull/9889"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "Mailing List"
      ],
      "url": "https://www.debian.org/security/2023/dsa-5507"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-149"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.