CVE-2023-36847
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on EX Series: * All versions prior to 20.4R3-S8; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S6; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S4; * 22.1 versions prior to 22.1R3-S3; * 22.2 versions prior to 22.2R3-S1; * 22.3 versions prior to 22.3R2-S2, 22.3R3; * 22.4 versions prior to 22.4R2-S1, 22.4R3.
Weaknesses (CWE)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Juniper Networks | Junos OS | 0 < 20.4R3-S8 (affected), 21.1 < 21.1* (affected), 21.2 < 21.2R3-S6 (affected), 21.3 < 21.3R3-S5 (affected), 21.4 < 21.4R3-S4 (affected), 22.1 < 22.1R3-S3 (affected), 22.2 < 22.2R3-S1 (affected), 22.3 < 22.3R2-S2, 22.3R3 (affected), 22.4 < 22.4R2-S1, 22.4R3 (affected) |
References & Technical Advisories
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Juniper Networks, Inc. · Vendor · USA |
| Reserved | 2023-06-27T16:17:25 |
| Published | 2023-08-17T19:16:53 |
| Patch Date | 2023-08-17 |
| Last Updated | 2025-10-21T23:05:40 |
Community Chatter & Buzz