CVE-2023-36479

Published Sep 15, 2023

Last updated a year ago

CVSS medium 4.3

Overview

Description: Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.
Source: security-advisories@github.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.3
Impact score: 1.4
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Severity: MEDIUM

Weaknesses

security-advisories@github.com: CWE-149

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "64EE3E5D-9A4F-4C6A-B723-101CF69F89F7",
            "versionEndExcluding": "9.4.52",
            "versionStartIncluding": "9.0.0"
          },
          {
            "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1D15B5CF-CDFA-4303-8A9F-CF2FAD8E10CC",
            "versionEndExcluding": "10.0.16",
            "versionStartIncluding": "10.0.0"
          },
          {
            "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9153C468-135C-49C4-B33B-1828E37AF483",
            "versionEndExcluding": "11.0.16",
            "versionStartIncluding": "11.0.0"
          },
          {
            "criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:alpha1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CA07CE23-17D8-4EFB-A6A2-97CCB8FF8461"
          },
          {
            "criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:alpha2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9A862281-65C6-47DC-9A13-521B9187C7CD"
          },
          {
            "criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:alpha3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4B999249-2A88-4270-8401-07CF57157D23"
          },
          {
            "criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:beta0:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C591F4A5-8A66-4A08-B969-C4264A98C7CF"
          },
          {
            "criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:beta1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9B9C2A15-1AC2-4DFA-849E-63657784FA3D"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
          },
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
          },
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

References