Attacker Value
Unknown
CVE-2023-36847
CVE-2023-36847
(Last updated June 28, 2024) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
With a specific request to installAppPackage.php that doesn’t require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of
integrity
for a certain
part of the file system, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on EX Series:
- All versions prior to 20.4R3-S8;
- 21.1 versions 21.1R1 and later;
- 21.2 versions prior to 21.2R3-S6;
- 21.3 versions
prior to
21.3R3-S5;
- 21.4 versions
prior to
21.4R3-S4;
- 22.1 versions
prior to
22.1R3-S3;
- 22.2 versions
prior to
22.2R3-S1;
- 22.3 versions
prior to
22.3R2-S2, 22.3R3;
- 22.4 versions
prior to
22.4R2-S1, 22.4R3.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
5.3 Medium
Impact Score:
1.4
Exploitability Score:
3.9
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
None
Integrity (I):
Low
Availability (A):
None
General Information
Vendors
- juniper
Products
- junos,
- junos 20.4,
- junos 21.1,
- junos 21.2,
- junos 21.3,
- junos 21.4,
- junos 22.1,
- junos 22.2,
- junos 22.3,
- junos 22.4
