Skip to content
Fencer Vulns
low 3.5

CVE-2023-36479 json

Jetty vulnerable to errant command quoting in CGI Servlet

published 2023-09-14 3 y ago modified 2026-09-10 1 mo ago also GHSA-3gh6-v5v9-6v9j , EUVD-2023-2405

cvss
3.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.

Patch / fix

  • maven org.eclipse.jetty:jetty-servlets 9.4.52, 10.0.16, 11.0.16
  • maven org.eclipse.jetty.ee10:jetty-ee10-servlets 12.0.0-beta2
  • maven org.eclipse.jetty.ee9:jetty-ee9-servlets 12.0.0-beta2
  • maven org.eclipse.jetty.ee8:jetty-ee8-servlets 12.0.0-beta2
  • eclipse jetty 9.4.52, 10.0.16, 11.0.16
  • jetty9 Debian 12 9.4.50-4+deb12u1
  • jetty9 Debian 14, Debian 13 9.4.52-1

debian advisories DEBIAN-CVE-2023-36479

  • foreman satellite utils 6.15, satellite capsule 6.15, satellite 6.15 3.9.1.6-1.el8sat
  • foreman-cli satellite utils 6.15, satellite 6.15 3.9.1.6-1.el8sat
  • foreman-ec2 satellite 6.15 3.9.1.6-1.el8sat
  • foreman-pcp satellite 6.15 3.9.1.6-1.el8sat
  • puppetserver satellite capsule 6.15, satellite capsule 6.14, satellite 6.15 +1 more 7.14.0-1.el8sat
  • rubygem-puma satellite 6.15 6.4.2-1.el8sat
  • foreman-ovirt satellite 6.15 3.9.1.6-1.el8sat
  • foreman-redis satellite 6.15 3.9.1.6-1.el8sat

red hat advisories RHSA-2024:2010RHSA-2024:0797

  • jetty-minimal SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +9 more 9.4.53-150200.3.22.1

suse advisories SUSE-SU-2023:4210-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-36479 updated cvss 3.5

jetty: Improper addition of quotation marks to user inputs in CgiServlet

  • Red Hat OpenShift Serverless org.kie.kogito-kogito-apps org.kie.kogito-kogito-apps
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux 7 jetty-io, jetty-ant, jetty-jmx, jetty-jsp, jetty-xml, jetty-http, +30 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 9 jetty-project
    affected: no fix available “Fix deferred”
  • Red Hat JBoss A-MQ 6 jetty-servlets Red Hat JBoss Fuse 6 jetty-servlets
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-metering-hive
    affected: no fix available “Fix deferred”
  • Red Hat Process Automation 7 jetty-servlets Red Hat streams for Apache Kafka jetty-servlets
    affected: no fix planned “Out of support scope”
  • Red Hat streams for Apache Kafka jetty
    under investigation
  • Red Hat Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-rhel8-operator 1.2-15, mtr/mtr-operator-bundle 1.2-23, mtr/mtr-web-container-rhel8 1.2-16, mtr/mtr-web-executor-container-rhel8 1.2-14
    fixed: vendor fix RHSA-2024:3919
show 6 more
  • Red Hat MTA 6.2 for RHEL 8 mta/mta-windup-addon-rhel9 6.2.3-2
    fixed: vendor fix RHSA-2024:3989
  • Red Hat Fuse 7.12.1
    fixed: vendor fix RHSA-2023:7247
  • Red Hat Fuse 7.13.0
    fixed: vendor fix RHSA-2024:3354
  • Red Hat Satellite 6.14 for RHEL 8 candlepin 4.3.11-1.el8sat, candlepin-selinux 4.3.11-1.el8sat
    fixed: vendor fix RHSA-2024:0797
  • Red Hat Satellite 6.15 for RHEL 8 puppetserver 7.14.0-1.el8sat
    fixed: vendor fix RHSA-2024:2010
  • Red Hat MTA 6.2 for RHEL 8 mta/mta-ui-rhel9 6.2.3-2, mta/mta-hub-rhel9 6.2.3-1, mta/mta-rhel8-operator 6.2.3-1, mta/mta-operator-bundle 6.2.3-4, mta/mta-pathfinder-rhel9 6.2.3-1 Red Hat AMQ Broker 7 jetty-servlets Red Hat Enterprise Linux 8 jetty-io, jetty-http, jetty-util, jetty-server, jetty-servlet, jetty-security, +1 more Red Hat JBoss Enterprise Application Platform 7 jetty Red Hat JBoss Enterprise Application Platform 8 jetty Red Hat JBoss Enterprise Application Platform Expansion Pack jetty
    +2 more products
    Red Hat Satellite 6.14 for RHEL 8 foreman 3.7.0.11-2.el8sat, mosquitto 2.0.17-1.el8sat, satellite 6.14.2-1.el8sat, rubygem-kafo 7.2.0-1.el8sat, rubygem-puma 6.3.1-1.el8sat, puppet-agent 7.27.0-1.el8sat, +26 more Red Hat Satellite 6.15 for RHEL 8 cjson 1.7.14-5.el8sat, libsolv 0.7.22-6.el8pc, katello 4.11.0-1.el8sat, libcomps 0.1.18-8.el8pc, python-jq 1.6.0-3.el8pc, foreman 3.9.1.6-1.el8sat, +678 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.16% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
NVD 3.1 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
GitHub 3.1 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven org.eclipse.jetty:jetty-servlets
>=9.0.0, <9.4.52
>=10.0.0, <10.0.16
>=11.0.0, <11.0.16
9.4.52
10.0.16
11.0.16
maven org.eclipse.jetty.ee10:jetty-ee10-servlets
<12.0.0-beta2
12.0.0-beta2
maven org.eclipse.jetty.ee9:jetty-ee9-servlets
<12.0.0-beta2
12.0.0-beta2
maven org.eclipse.jetty.ee8:jetty-ee8-servlets
<12.0.0-beta2
12.0.0-beta2

Affected products

  • eclipse jetty.project

Classification

Weakness
  • CWE-149 Improper Neutralization of Quoting Syntax

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.