3.5

CVE-2023-36479: Jetty vulnerable to errant command quoting in CGI Servlet

Analyzed
AliasesUBUNTU-CVE-2023-36479DEBIAN-CVE-2023-36479CGA-4925-gm4c-9gpc
Published 15-09-2023Last modified 18-06-2025

Vulnerability summary

CVE-2023-36479 is a low (CVSS 3.5) vulnerability in debian debian_linux. EPSS estimates a 1.16% chance of exploitation in the next 30 days, higher than 67.2% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Routine

Not severe (CVSS 3.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
3.5/10
010
Low · v3.1 (CVE.org)
EPSS score
1.16%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 5 · Related 6
DLA-3592-1DSA-5507-1RHSA-2024:0797RHSA-2024:2010SUSE-SU-2023:4210-1CGA-43HC-98FX-VR64

Timeline

  1. 15-09-2023
    PublishedVulnerability first disclosed.
  2. 18-06-2025
    Last modifiedVulnerability information updated.

Description

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

1.16%

Chance of exploitation in the next 30 days

Percentile

67%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.16% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Jetty.Project

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard7 products
  • apache-hop< 2.15.0-r2
  • apache-hop-fips< 2.15.0-r2
  • cassandra-reaper< 4.0.1-r1
  • cloudwatch-exporter< 0.15.4-r3
  • hadoop-fips-3.3.6All versions (No fix recorded)
Debian2 products
  • jetty9< 9.4.50-4+deb12u1 | < 9.4.52-1
  • debian_linuxEOL10.0 | 11.0 | 12.0
Eclipse2 products
  • jetty≥ 9.0.0, < 9.4.52 | ≥ 10.0.0, < 10.0.16 | ≥ 11.0.0, < 11.0.16 | 12.0.0:alpha1 | 12.0.0:alpha2 | 12.0.0:alpha3 | 12.0.0:beta0 | 12.0.0:beta1
  • jetty.project≥ 9.0.0, ≤ 9.4.51 | ≥ 10.0.0, ≤ 10.0.15 | ≥ 11.0.0, ≤ 11.0.15 | ≤ 12.0.0-beta1
Wolfi2 products
  • cassandra-reaper< 4.0.1-r1
  • cloudwatch-exporter< 0.15.4-r3
Org.eclipse.jetty1 product
  • jetty-servlets≥ 9.0.0, < 9.4.52 | ≥ 10.0.0, < 10.0.16 | ≥ 11.0.0, < 11.0.16
Org.eclipse.jetty.ee101 product
  • jetty-ee10-servlets< 12.0.0-beta2
Org.eclipse.jetty.ee81 product
  • jetty-ee8-servlets< 12.0.0-beta2
Org.eclipse.jetty.ee91 product
  • jetty-ee9-servlets< 12.0.0-beta2
Ubuntu1 product
  • jettyAll versions (No fix recorded)

9 vendors · 18 products

References

12 links
Show all 12 references