{"id":"CVE-2023-36479","summary":"Jetty vulnerable to errant command quoting in CGI Servlet","details":"Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.","aliases":["GHSA-3gh6-v5v9-6v9j"],"modified":"2026-05-18T05:56:40.488214530Z","published":"2023-09-15T18:37:35.948Z","related":["CGA-4jch-hfv5-2v2v","SUSE-SU-2023:4210-1","openSUSE-SU-2024:13329-1"],"database_specific":{"cwe_ids":["CWE-149"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36479.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36479.json"},{"type":"ADVISORY","url":"https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36479"},{"type":"ADVISORY","url":"https://www.debian.org/security/2023/dsa-5507"},{"type":"FIX","url":"https://github.com/eclipse/jetty.project/pull/9516"},{"type":"FIX","url":"https://github.com/eclipse/jetty.project/pull/9888"},{"type":"FIX","url":"https://github.com/eclipse/jetty.project/pull/9889"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jetty/jetty.project","events":[{"introduced":"432f896d7a4555fcc81f38108757ea0aca8788e6"},{"fixed":"bedff458c4dd1a716d59e17b8cb0d2042eeab291"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-36479.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"}]}