CVE-2023-36846
Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files
- Published
- Updated
- Reserved
- Assigned by
- juniper
Description
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on SRX Series: * All versions prior to 20.4R3-S8; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S6; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S3; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R2-S2, 22.3R3; * 22.4 versions prior to 22.4R2-S1, 22.4R3.
Exploited in the wild
CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability.
- Added
- 13 Nov 2023
- Fix due (US federal)
- 17 Nov 2023
- Used by ransomware
- Not known
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: it is being exploited.
Timeline
ID reserved
By juniper
- 51 days later
· 51 days later
Published
- 3 months later
· 3 months later
Added to CISA KEV
Known exploited in the wild
- 24 months later
· 24 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| juniperCNA (assigner) | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVDNVD · Analyzed | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
- EPSS (exploitation in 30 days)
- 93.5% · top 0.2% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: active · Automatable: yes · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.
Weakness
Affected products
- affected < 20.4R3-S8
- affected 21.1 – < 21.1*
- affected 21.2 – < 21.2R3-S6
- affected 21.3 – < 21.3R3-S5
- affected 21.4 – < 21.4R3-S5
- affected 22.1 – < 22.1R3-S3
- affected 22.2 – < 22.2R3-S2
- affected 22.3 – < 22.3R2-S2, 22.3R3
- affected 22.4 – < 22.4R2-S1, 22.4R3
What to do
Solution: The following software releases have been updated to resolve this specific issue: 20.4R3-S8, 21.2R3-S6, 21.3R3-S5*, 21.4R3-S5*, 22.1R3-S3, 22.2R3-S2, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3*, 23.2R1, and all subsequent releases. *Pending Publication
Workaround: Disable J-Web, or limit access to only trusted hosts.
Exploitation: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
References (2)
- https://supportportal.juniper.net/JSA72300 (opens in a new tab)vendor-advisorymitigationx_transferred
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36846 (opens in a new tab)government-resource
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- CISA KEV catalog (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-36846)Record last updated .