CVE-2023-36479

Katalog CVE

CVSS 3.1 · Low EPSS 1,2%

Kerentanan Improper Neutralization of Quoting Syntax pada eclipse jetty, debian linux. Skor CVSS 3.1 3.1 (Low) menurut NVD.

Deskripsi (NVD)

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.

Rincian

Terbit di NVD

15 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.1 (Low), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-149: Improper Neutralization of Quoting Syntax

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j exploit · patch · advisory vendor
• https://github.com/eclipse/jetty.project/pull/9516 patch
• https://github.com/eclipse/jetty.project/pull/9888 patch
• https://github.com/eclipse/jetty.project/pull/9889 patch
• https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html mailing list · advisory pihak ketiga
• https://www.debian.org/security/2023/dsa-5507 mailing list · advisory pihak ketiga