A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
With a specific request to user.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of
integrity
for a certain
part of the file system, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on SRX Series:
* All versions prior to 20.4R3-S8;
* 21.1 versions 21.1R1 and later;
* 21.2 versions prior to 21.2R3-S6;
* 21.3 versions
prior to
21.3R3-S5;
* 21.4 versions
prior to
21.4R3-S5;
* 22.1 versions
prior to
22.1R3-S3;
* 22.2 versions
prior to
22.2R3-S2;
* 22.3 versions
prior to
22.3R2-S2, 22.3R3;
* 22.4 versions
prior to
22.4R2-S1, 22.4R3.
Connections 30
has cited scope1 retained · stored CVE-2023-36846 → Juniper Networks · Junos OScad509f1-e89e-481c-a4f2-92a2d27dacba
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx1102b923760-fc14-470a-97ab-e4aa1fae859f
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx4000fddce605-06a1-41dd-baa4-524f44c691f9
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx380a5d67e37-c875-4828-a6f4-a0f4f504a80f
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx345d133e492-446b-4c94-975b-e586867cef62
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx65019aa8934-fb33-43e8-8e22-89b77e4365c0
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx550_hma921a511-ecc1-48c7-aa5b-73ddbdd0d83b
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx15003e03ef5e-2ef8-4567-a9eb-3d2e499a7150
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx5800e691a72a-b26e-4bd3-9af3-dae67085e908
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx240h2aae92c70-8962-4b84-a3dd-37c188295e2f
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx340d295f4c6-70de-45bc-8fe1-88bb7a088704
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx560017064c2a-8d7a-481b-a2d6-0d8c136e551f
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx420009c0fb0c-dd80-404b-a782-51ef20394744
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx21003cf1361-f5bd-49c1-8992-17255f02db5b
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx3205f995e19-d783-499b-a5e7-49b66f58b783
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx3600a3c66e5f-9c08-46e3-81e5-cff5d495fe97
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx300013df85d-18a1-4d04-9158-f1a46ce86f10
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx55052bce5a0-6695-4e79-8959-e62889d96ec0
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx4600edbe2d0f-7028-4f4f-ae0d-623e6dee4cb6
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx550m0468e9e1-004e-4e92-bcc3-bfadf844e51e
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx540067de788c-c89c-4d90-9e5d-cbc183f2bc80
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx1003b3e9b85-d89e-4cdf-b71a-68d4905f9df9
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx22034653d77-d2fe-4be2-9bfd-eb1bd0d87158
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx4100819ff745-b32e-4c9d-aad5-275de7a32464
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx1400b188000b-5f2b-4745-96b9-1abcebd64b3a
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx240m1c02a44d-d026-41d7-abfb-e9e204b9200d
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx500009bce8f2-6b31-4e6b-bb11-8f1914140e77
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx3400050ee28b-d3a6-4187-8f6e-6b4cd392e15b
has environmental constraint1 retained · stored CVE-2023-36846 → juniper · srx240f209d7ba-5c5d-4fa3-8d8b-50e53710e78b
has vulnerable target scope89 retained · stored CVE-2023-36846 → juniper · junos008c32ce-3f35-4b42-a534-32787964e00501f11f31-38bf-4717-a031-d94334b4c56909dac761-f64d-454e-8557-9fd5a4f9df420a0fb04c-8abb-4123-a93b-1839f1136c170a157f52-8dfa-44c5-b3e2-f144093490130ad5c333-950d-4298-a834-9681aa49cfc2