{"id":"CVE-2023-36479","summary":"Jetty vulnerable to errant command quoting in CGI Servlet","details":"Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.","aliases":["GHSA-3gh6-v5v9-6v9j"],"modified":"2026-04-10T05:00:17.590073Z","published":"2023-09-15T18:37:35.948Z","related":["CGA-4jch-hfv5-2v2v","SUSE-SU-2023:4210-1","openSUSE-SU-2024:13329-1"],"database_specific":{"cna_assigner":"GitHub_M","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36479.json","cwe_ids":["CWE-149"]},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36479.json"},{"type":"ADVISORY","url":"https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36479"},{"type":"ADVISORY","url":"https://www.debian.org/security/2023/dsa-5507"},{"type":"FIX","url":"https://github.com/eclipse/jetty.project/pull/9516"},{"type":"FIX","url":"https://github.com/eclipse/jetty.project/pull/9888"},{"type":"FIX","url":"https://github.com/eclipse/jetty.project/pull/9889"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/eclipse/jetty.project","events":[{"introduced":"1237b739c787a75a5f9e1f495b3f2c8284761499"},{"last_affected":"b45c405e4544384de066f814ed42ae3dceacdd49"}],"database_specific":{"versions":[{"introduced":"9.0.0"},{"last_affected":"9.4.51"}]}},{"type":"GIT","repo":"https://github.com/eclipse/jetty.project","events":[{"introduced":"b9645a17373e4e9b7f30b6c0a07defcea2cb660b"},{"last_affected":"68017dbd00236bb7e187330d7585a059610f661d"}],"database_specific":{"versions":[{"introduced":"10.0.0"},{"last_affected":"10.0.15"}]}},{"type":"GIT","repo":"https://github.com/eclipse/jetty.project","events":[{"introduced":"432f896d7a4555fcc81f38108757ea0aca8788e6"},{"last_affected":"5bc5e562c8d05c5862505aebe5cf83a61bdbcb96"}],"database_specific":{"versions":[{"introduced":"11.0.0"},{"last_affected":"11.0.15"}]}},{"type":"GIT","repo":"https://github.com/eclipse/jetty.project","events":[{"introduced":"0"},{"last_affected":"f98b345a28fcefbf1fa8e16dc4b44605b68f2c62"}],"database_specific":{"versions":[{"introduced":"0"},{"last_affected":"12.0.0-beta1"}]}}],"versions":["jetty-11.0.0-alpha0","jetty-11.0.0.beta1","jetty-11.0.0.beta2","jetty-11.0.2","jetty-11.0.8","jetty-11.0.9","jetty-12.0.0.beta1","jetty-8.0.0.RC0","jetty-8.1.0.RC0","jetty-9.1.0.M0","jetty-9.1.0.RC0","jetty-9.1.0.RC1","jetty-9.1.0.RC2","jetty-9.1.0.v20131115","jetty-9.1.1.v20140108","jetty-9.1.2.v20140210","jetty-9.1.3.v20140225","jetty-9.1.4.v20140401","jetty-9.2.0.M0","jetty-9.2.0.M1","jetty-9.2.0.RC0","jetty-9.2.0.v20140523","jetty-9.2.0.v20140526","jetty-9.2.1.v20140609"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-36479.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"}]}