ACTIEF MISBRUIKT
CVE-2023-36846: Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
| Leverancier | Juniper |
|---|---|
| Product | Junos OS |
| Actief misbruikt | Ja |
| Toegevoegd aan CISA KEV | 13 nov 2023 |
| CISA-deadline (Amerikaanse overheid) | 17 nov 2023 |
| Zwakte (CWE) | CWE-306 |
Vereiste actie (tekst van CISA, Engels)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Beschrijving (NVD, Engels)
Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.
BRONNEN
Andere lekken bij Juniper
- CVE-2015-7755: Juniper ScreenOS Improper Authentication Vulnerability
- CVE-2025-21590: Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability
- CVE-2023-36851: Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
- CVE-2023-36847: Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability
- CVE-2023-36845: Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability
Gegevens van NVD, CISA KEV, FIRST EPSS en adviezen van leveranciers. Bijgewerkt 10 nov 2026.