A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
With a specific request to installAppPackage.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of
integrity
for a certain
part of the file system, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on EX Series:
* All versions prior to 20.4R3-S8;
* 21.1 versions 21.1R1 and later;
* 21.2 versions prior to 21.2R3-S6;
* 21.3 versions
prior to
21.3R3-S5;
* 21.4 versions
prior to
21.4R3-S4;
* 22.1 versions
prior to
22.1R3-S3;
* 22.2 versions
prior to
22.2R3-S1;
* 22.3 versions
prior to
22.3R2-S2, 22.3R3;
* 22.4 versions
prior to
22.4R2-S1, 22.4R3.
Connections 65
has cited scope1 retained · stored CVE-2023-36847 → Juniper Networks · Junos OS7d1f7ea1-7847-4bac-8e27-ceba5e6b0ed8
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-mp63666b70-109a-4120-b452-8d79488caaa3
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4600-vc6a685a0c-c0eb-48fc-adff-6ab312118fe8
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-48tdcb00174b4-abc5-40bd-93b0-c908953ca33f
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300025d0e75-e7b5-4cc0-8a50-4af3323dc5eb
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-48t-dcf24ed188-fd58-462d-a80a-cc3d39b7bf2d
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex2300-48mp01ef0725-5cfe-44cb-ba7e-7e245f49f940
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex82165cfee8b8-c19d-4c54-ad36-9afdb7251ad2
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex92087331049e-0d3a-4a79-a3c7-19cee0d31dca
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex3300d7804d87-4b2e-4eb6-99ca-98d2f6487493
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-48mpe10a7345-783e-4026-a71f-3275d27becae
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex2300-24t61a51f54-ba93-4383-b1db-4f898a9de6ab
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex2200-vcdf4b7a80-e5a2-4ccb-b318-724a25051d15
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex92539a0f5a78-eff8-4bef-af37-5563f9762a75
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex92049dd217dd-e026-4ae1-86d7-b07825991e75
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4500390e69cd-3bd2-4845-9862-c1e03ec58d8b
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-48t-dc-afi08956860-d867-4f35-af36-625b189202f4
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex44009bbc7e1f-b4d5-4342-a991-9070c796f441
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex2300-24mpbb037265-3e4f-481b-a69f-c1df47c09b68
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4500-vc6c124064-f757-453f-9345-bd3e50a817c1
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex820009619d49-7761-4cf6-aef4-dea74b082b9e
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-32f-sce72e3c1-895b-4c82-bb52-18344b150be0
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex2300m14ac86c3-af32-4ad5-92ea-b74afdcf7e46
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex8200-vc9f7e8682-18d9-4da6-85e1-bc3ca91269f5
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-32f1a042d8a-99b7-41ab-bf7c-11002547c257
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-24t-s187d5f87-c19f-4c89-a60b-f6df528a9c0c
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4600ac116f00-e1ec-42b5-9c5d-099503de1113
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-24p-s494e1657-90a4-4c40-9ecc-72a75b05fad9
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex23008eb04fed-a961-48bc-95fa-ff3975726a98
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-48tafi20fa1553-3351-4189-ad29-674b0d1d7cf4
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-48mp-sd3313b2c-9fcd-4266-8eaf-85c07021484c
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex32004cc94e88-8ba2-496c-b689-e4fdf4489ea0
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex2200-c94b889c4-96c6-43fe-bf90-15c76c78d3aa
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex2300-48pebedd4b6-b45e-4997-a7b1-59ba1f48fd8d
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex340057e288b2-3c42-4cb4-b1e4-c52b2e666d38
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-24p46f7ae5e-76be-48c1-9684-af2d4fe80e65
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300mcc6b81e7-a3a2-429e-be82-085055bd0220
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4200834e6e83-c2b6-421f-a3ed-7e74f073c22c
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-48t-s6b2fb7f7-cf86-4f42-a5a1-4ec3bd40ad8c
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex9250ccd4be3f-0dc9-4499-878d-e27027564aa0
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4550/vc3e1e35ce-a346-4244-a942-47611099715a
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex2300-24pc1e5759f-84ee-409b-99e2-a168593dafb0
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-48t19c9c52d-c469-47da-88d5-571187852310
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex3300-vc2620d453-8aaf-49d3-9103-8091c8ae8f6c
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex9200214d9e80-3156-46e2-a782-64df144b12d1
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-24t76bb3a82-9fef-4d3f-9b5b-a80e603bdac0
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex2200ef3a96a9-fa7b-473d-a2b2-1dbf35a6a28e
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex6210973b1fae-fa08-4121-827d-ba4bb236cd97
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4550b6349140-8609-48d5-8c84-5f9e8b798162
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex2300-48tc6818b9b-c85c-41c7-826e-345e058f5359
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-32f-dc5307be4b-8a4c-4bff-bdc9-a330af88050c
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex6200510528cf-de09-40ae-92bc-d0e1799ea6b5
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-48t-afi5749d0ee-2256-4b23-8025-d8708f5a504e
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex820840badcc0-3740-46f4-b669-9ded3a0ca43f
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-vc4411e37d-fc43-4a88-bd30-a12a5caa8293
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex46502c035022-2379-4e36-8c87-d0c5aa3cf0d2
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex9251c9ad14f3-4933-4522-ac69-3c1a7892c11b
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-48p-s6a713d7d-f386-498e-a8e5-6637edbd03dc
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex2300-ce4de5252-d3d5-4425-8ccc-5fe6907ea14d
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4550-vcef14f0ba-42b6-46d3-9948-4b52bf7eba05
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex92146eb050a8-8f9a-4415-a9dc-5a590ac90c21
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4200-vc4eace907-3555-4d56-a5b4-ff94dfe166fb
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-48tdc-afi995f3284-c308-4b4b-9400-b6211a005e1e
has environmental constraint1 retained · stored CVE-2023-36847 → juniper · ex4300-48pb8d03c67-ec21-4e54-b0b5-1779aca1ce75
has vulnerable target scope91 retained · stored CVE-2023-36847 → juniper · junos05bc59e5-41aa-494e-8f8f-84024cad2acd08e2f5a0-7c5a-4530-9c39-d79e617109a10ed10dfb-1309-401d-9cbe-6491562317fd0f27312b-660f-44b6-8822-f2574bd26f261229094c-ab72-482e-a111-5b4596ac3d8012c14f17-66da-4522-b318-647bf83861c4