Home / Vulnerabilities / CVE-2023-36851
MEDIUM SEVERITY
CVE-2023-36851 Juniper · Junos OS

Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability

Technical Severity

CVSS v3.1 Metrics

MEDIUM
5.3 / 10
Minimal Risk Critical
Vector Specification
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitation Likelihood

EPSS Prediction

15.29 %
Predictive Probability
Percentile Rank
94.4 th

Documented as more likely to be exploited than 94.4% of known CVEs.

Detection Date

Nov 13, 2023

Remediation Due

Nov 17, 2023

CISA Catalog Active

Threat Analysis

Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.

Remediation Directive

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

External Intelligence

https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US

https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US
NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2023-36851