CVE-2023-36847: Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: yes — in CISA KEV since 2023-11-13
EPSS: 83.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-17 · updated 2026-06-17
Weakness: CWE-306

Description

A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on EX Series: * All versions prior to 20.4R3-S8; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S6; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S4; * 22.1 versions prior to 22.1R3-S3; * 22.2 versions prior to 22.2R3-S1; * 22.3 versions prior to 22.3R2-S2, 22.3R3; * 22.4 versions prior to 22.4R2-S1, 22.4R3.

Summary

CVE-2023-36847 is a missing authentication flaw in Juniper Junos OS on EX Series switches: an unauthenticated, network-based attacker can send a crafted request to installAppPackage.php via J-Web to upload arbitrary files, compromising file system integrity and potentially chaining to other flaws. It affects all versions prior to 20.4R3-S8, 21.1R1 and later, and numerous 21.2, 21.3, 21.4, 22.1, 22.2, 22.3 and 22.4 releases before their listed fixed builds. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, and EPSS estimates an 83.5% chance of exploitation within 30 days. Apply the vendor's fixed releases (such as 20.4R3-S8 and the listed 21.x/22.x maintenance builds) or follow Juniper's mitigations, and restrict J-Web access where possible.

CVE-2023-36847 ثغرة غياب المصادقة على وظيفة حرجة في Juniper Junos OS على سويتشات EX Series، إذ يستطيع مهاجم غير مصادَق عبر الشبكة إرسال طلب مُصمَّم إلى installAppPackage.php عبر J-Web لرفع ملفات عشوائية، ما يضر بسلامة نظام الملفات وقد يسمح بتسلسل الثغرات. تشمل الإصدارات المتأثرة كل الإصدارات الأقدم من 20.4R3-S8، والإصدار 21.1R1 وما بعده، وإصدارات 21.2 و21.3 و21.4 و22.1 و22.2 و22.3 و22.4 الأقدم من إصدارات الإصلاح المحددة. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة الاستغلال مع استغلال نشط، وتقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 83.5%. طبّق إصدارات الإصلاح من المورّد (مثل 20.4R3-S8 وإصدارات الصيانة المحددة في 21.x و22.x) أو اتبع تخفيفات Juniper، وقيّد الوصول إلى J-Web حيث أمكن.

Affected products

Juniper Junos OS: before 20.4; 20.4, 20.4-r1, 20.4-r1-s1, 20.4-r2, 20.4-r2-s1, 20.4-r2-s2 (+84) — fixed in 20.4

How to fix

Upgrade to a fixed version: Juniper Junos OS 20.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-36847 or the next vulnerability affects your stack