CVE-2023-36479

Jetty vulnerable to errant command quoting in CGI Servlet

LOW

3.1

CVSS Score

Published: September 15, 2023 at 06:37 PM UTC

Updated: June 17, 2026 at 06:06 AM UTC

2 products affected across 2 vendorsDebian LinuxJetty

Using jetty.project by eclipse?

Get instant alerts when new vulnerabilities affect jetty.project - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

LOW3.1

Exploit prediction

EPSS 1%

SSVC

No known exploit

Description

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

10.0 11.0 12.0

Jetty · Eclipsemaven

95%

v ≤ 10.0.15v ≤ 11.0.15v ≤ 12.0.0-beta1v ≤ 9.4.5110.0.0 ≤ v < 10.0.1611.0.0 ≤ v < 11.0.169.0.0 ≤ v < 9.4.5212.0.0 alpha1 12.0.0 alpha2 12.0.0 alpha3 12.0.0 beta0 12.0.0 beta1

Affected range stops below 10.0.16, so it looks safe — our inference, not a vendor statement

Affected range stops below 11.0.16, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.4.52, so it looks safe — our inference, not a vendor statement