A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
With a specific request to installAppPackage.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of
integrity
for a certain
part of the file system, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on EX Series:
* All versions prior to 20.4R3-S8;
* 21.1 versions 21.1R1 and later;
* 21.2 versions prior to 21.2R3-S6;
* 21.3 versions
prior to
21.3R3-S5;
* 21.4 versions
prior to
21.4R3-S4;
* 22.1 versions
prior to
22.1R3-S3;
* 22.2 versions
prior to
22.2R3-S1;
* 22.3 versions
prior to
22.3R2-S2, 22.3R3;
* 22.4 versions
prior to
22.4R2-S1, 22.4R3.
References
| Link | Resource |
|---|---|
| https://supportportal.juniper.net/JSA72300 | Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
History
No history.
Information
Published : 2023-08-17 20:15
Updated : 2023-09-27 15:18
NVD link : CVE-2023-36847
Mitre link : CVE-2023-36847
CVE.ORG link : CVE-2023-36847
JSON object : View
Products Affected
juniper
- ex4300-vc
- ex4300-48tafi
- ex9208
- ex4300-32f
- ex4500-vc
- ex4550\/vc
- ex4650
- ex8200
- srx550m
- srx550
- ex9253
- srx345
- ex2300m
- srx5600
- srx300
- ex2300-48mp
- ex2200
- ex8216
- ex8208
- ex4300-48tdc
- ex4300-48p
- ex2200-c
- ex4200-vc
- ex4550
- ex8200-vc
- ex2300-48p
- ex4300-48t-afi
- ex4300-24t
- ex4300-48mp
- srx380
- ex4300-32f-dc
- ex4550-vc
- ex2300
- srx650
- ex3300-vc
- ex9250
- ex4300-48t-dc
- srx550_hm
- srx4600
- srx3600
- ex4300
- ex3300
- ex4300-32f-s
- ex9204
- ex4300-24p-s
- ex4400
- srx4100
- srx5000
- ex6210
- srx100
- ex9251
- srx320
- srx340
- srx4200
- ex4200
- ex9214
- ex2300-24mp
- ex6200
- ex3400
- srx5800
- ex4300-48t
- ex2300-48t
- srx240h2
- ex2300-24t
- ex4300-mp
- srx110
- srx240
- ex4300m
- ex2300-24p
- ex4300-48tdc-afi
- ex4300-48t-s
- ex4300-48p-s
- srx4000
- srx240m
- ex4300-24t-s
- junos
- ex4300-48mp-s
- ex4300-24p
- ex4500
- srx5400
- ex9200
- ex4600-vc
- srx3400
- srx1500
- ex2300-c
- srx220
- srx1400
- ex4300-48t-dc-afi
- ex4600
- ex2200-vc
- srx210
- ex3200
CWE
CWE-306
Missing Authentication for Critical Function
