Arbitrary Code Execution

2023-09-2010:17:36

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

jetty-servlets

arbitrary code execution

vulnerability

user input handling

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

0.001 Low

EPSS

Percentile

23.1%

JSON

Jetty-servlets is vulnerable to Arbitrary Code Execution. The vulnerability is due to insecure escaping of user input which can result in the execution of arbitrary commands. This vulnerability occurs in the CGI servlet handler through the getRuntime.exec() method.

CPENameOperatorVersion
ee10 :: utility servlets and filtersle12.0.0.beta0
ee8 :: utility servlets and filtersle12.0.0.beta0
jetty :: utility servlets and filtersle10.0.15
jetty :: utility servlets and filtersle11.0.15
jetty :: utility servlets and filtersle9.4.51.v20230217
ee9 :: utility servlets and filtersle12.0.0.beta0
jetty9:bullseyeeq9.4.33-1
jetty9:bullseyeeq9.4.36-1
jetty9:bustereq9.4.15-1
jetty9:bustereq9.4.16-0+deb10u1

Name	Operator	Version
ee10 :: utility servlets and filters	le	12.0.0.beta0
ee8 :: utility servlets and filters	le	12.0.0.beta0
jetty :: utility servlets and filters	le	10.0.15
jetty :: utility servlets and filters	le	11.0.15
jetty :: utility servlets and filters	le	9.4.51.v20230217
ee9 :: utility servlets and filters	le	12.0.0.beta0
jetty9:bullseye	eq	9.4.33-1
jetty9:bullseye	eq	9.4.36-1
jetty9:buster	eq	9.4.15-1
jetty9:buster	eq	9.4.16-0+deb10u1