UpHeron
All vulnerabilities

Servers and applications

CVE-2023-36479

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an…

Severity
Low 3.1
Published
15 Sept 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
9.4.52, 10.0.16, 11.0.16
Sources
NVD

Affected software

SoftwareAffected versions
Eclipse JettyServers and applications · cpe:a:eclipse:jetty
  • Version 12.0.0-beta1
  • Version 12.0.0-beta0
  • Version 12.0.0-alpha3
  • Version 12.0.0-alpha2
All 8 release lines
  • From 9.0.0 before 9.4.52
  • From 10.0.0 before 10.0.16
  • From 11.0.0 before 11.0.16
  • Version 12.0.0-alpha1
  • Version 12.0.0-alpha2
  • Version 12.0.0-alpha3
  • Version 12.0.0-beta0
  • Version 12.0.0-beta1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-36479
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-36479