CVE-2023-36847 Juniper Junos OS EX Series Missing Authentication for Critical Function
Unauthenticated attackers can upload arbitrary files via J-Web on Juniper EX Series devices, compromising file system integrity.
- Exploited in the wild
- Since 13 Nov 2023
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-36847?
CVE-2023-36847 is a medium-severity vulnerability in Juniper Junos, published on 17 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
With a specific request to installAppPackage.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of
integrity
for a certain
part of the file system, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on EX Series:
* All versions prior to 20.4R3-S8; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S6; * 21.3 versions
prior to
21.3R3-S5; * 21.4 versions
prior to
21.4R3-S4; * 22.1 versions
prior to
22.1R3-S3; * 22.2 versions
prior to
22.2R3-S1; * 22.3 versions
prior to
22.3R2-S2, 22.3R3; * 22.4 versions
prior to
22.4R2-S1, 22.4R3.
Weakness: CWE-306
Which versions are affected by CVE-2023-36847?
It affects 1 product.
Products include Juniper Junos.
How do I fix CVE-2023-36847?
No fix has been published for CVE-2023-36847 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 17 Nov 2023.
Is CVE-2023-36847 being exploited?
Yes. Attackers have exploited CVE-2023-36847 in the wild since at least 13 Nov 2023.
Other vulnerabilities in Juniper Junos
- CVE-2023-36845 Juniper Junos OS EX Series and SRX Series PHP External Variable Modification
- CVE-2020-1631 Juniper Junos OS Path Traversal
- CVE-2025-21590 Juniper Junos OS Improper Isolation or Compartmentalization
- CVE-2023-36851 Juniper Junos OS SRX Series Missing Authentication for Critical Function
- CVE-2023-36844 Juniper Junos OS EX Series PHP External Variable Modification
Sources
Also known as GHSA-c38p-r7xc-grgp.