{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-36479", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-06-21T18:50:41.704Z", "datePublished": "2023-09-15T18:37:35.948Z", "dateUpdated": "2023-09-15T18:37:35.948Z"}, "containers": {"cna": {"title": "Jetty vulnerable to errant command quoting in CGI Servlet", "problemTypes": [{"descriptions": [{"cweId": "CWE-149", "lang": "en", "description": "CWE-149: Improper Neutralization of Quoting Syntax", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j"}, {"name": "https://github.com/eclipse/jetty.project/pull/9516", "tags": ["x_refsource_MISC"], "url": "https://github.com/eclipse/jetty.project/pull/9516"}, {"name": "https://github.com/eclipse/jetty.project/pull/9888", "tags": ["x_refsource_MISC"], "url": "https://github.com/eclipse/jetty.project/pull/9888"}, {"name": "https://github.com/eclipse/jetty.project/pull/9889", "tags": ["x_refsource_MISC"], "url": "https://github.com/eclipse/jetty.project/pull/9889"}, {"url": "https://www.debian.org/security/2023/dsa-5507"}, {"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html"}], "affected": [{"vendor": "eclipse", "product": "jetty.project", "versions": [{"version": ">= 9.0.0, <= 9.4.51", "status": "affected"}, {"version": ">= 10.0.0, <= 10.0.15", "status": "affected"}, {"version": ">= 11.0.0, <= 11.0.15", "status": "affected"}, {"version": "<= 12.0.0-beta1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-09-15T18:37:35.948Z"}, "descriptions": [{"lang": "en", "value": "Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.\n"}], "source": {"advisory": "GHSA-3gh6-v5v9-6v9j", "discovery": "UNKNOWN"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "matchCriteriaId": "64EE3E5D-9A4F-4C6A-B723-101CF69F89F7", "versionEndExcluding": "9.4.52", "versionStartIncluding": "9.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "matchCriteriaId": "1D15B5CF-CDFA-4303-8A9F-CF2FAD8E10CC", "versionEndExcluding": "10.0.16", "versionStartIncluding": "10.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "matchCriteriaId": "9153C468-135C-49C4-B33B-1828E37AF483", "versionEndExcluding": "11.0.16", "versionStartIncluding": "11.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "CA07CE23-17D8-4EFB-A6A2-97CCB8FF8461", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:alpha2:*:*:*:*:*:*", "matchCriteriaId": "9A862281-65C6-47DC-9A13-521B9187C7CD", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:alpha3:*:*:*:*:*:*", "matchCriteriaId": "4B999249-2A88-4270-8401-07CF57157D23", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:beta0:*:*:*:*:*:*", "matchCriteriaId": "C591F4A5-8A66-4A08-B969-C4264A98C7CF", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "9B9C2A15-1AC2-4DFA-849E-63657784FA3D", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*", "matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.\n"}, {"lang": "es", "value": "Eclipse Jetty Canonical Repository es el repositorio can\u00f3nico para el proyecto Jetty. Los usuarios de CgiServlet con una estructura de comando muy espec\u00edfica pueden ejecutar el comando incorrecto. Si un usuario env\u00eda una solicitud a un servlet org.eclipse.jetty.servlets.CGI para un binario con un espacio en su nombre, el servlet escapar\u00e1 del comando envolvi\u00e9ndolo entre comillas. Este comando empaquetado, m\u00e1s un prefijo de comando opcional, se ejecutar\u00e1 mediante una llamada a Runtime.exec. Si el nombre binario original proporcionado por el usuario contiene una comilla seguida de un espacio, la l\u00ednea de comando resultante contendr\u00e1 varios tokens en lugar de uno. Este problema se solucion\u00f3 en las versiones 9.4.52, 10.0.16, 11.0.16 y 12.0.0-beta2."}], "id": "CVE-2023-36479", "lastModified": "2023-10-16T19:20:18.767", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-09-15T19:15:08.387", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/eclipse/jetty.project/pull/9516"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/eclipse/jetty.project/pull/9888"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/eclipse/jetty.project/pull/9889"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j"}, {"source": "security-advisories@github.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2023/dsa-5507"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-149"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}