{"cve_id":"CVE-2023-36847","published":"2023-08-17T20:15:10.553000+00:00","last_modified":"2026-06-17T06:07:13.203000+00:00","vuln_status":"Analyzed","description":"A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\n\n\nWith a specific request to installAppPackage.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of \n\nintegrity\n\nfor a certain \n\npart of the file system, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on EX Series:\n\n\n\n  *  All versions prior to 20.4R3-S8;\n  *  21.1 versions 21.1R1 and later;\n  *  21.2 versions prior to 21.2R3-S6;\n  *  21.3 versions \n\nprior to \n\n 21.3R3-S5;\n  *  21.4 versions \n\nprior to \n\n21.4R3-S4;\n  *  22.1 versions \n\nprior to \n\n22.1R3-S3;\n  *  22.2 versions \n\nprior to \n\n22.2R3-S1;\n  *  22.3 versions \n\nprior to \n\n22.3R2-S2, 22.3R3;\n  *  22.4 versions \n\nprior to \n\n22.4R2-S1, 22.4R3.","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","base_score":5.3,"base_severity":"MEDIUM","attack_vector":"NETWORK","privileges_req":"NONE","user_interaction":"NONE","scope":"UNCHANGED","impact_c":"NONE","impact_i":"LOW","impact_a":"NONE","cwe_ids":["CWE-306"],"in_kev":true,"kev_date_added":"2023-11-13","kev_ransomware":false,"epss_score":0.83455,"epss_percentile":0.99684,"cap_rule_version":"0.1.1","stage":"INITIAL_ACCESS","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":false,"grant_access":"USER","caps":["AUTH_BYPASS","TAMPER"],"terminal":false,"cap_confidence":"high","ingested_at":"2026-09-18T10:36:02.794852+00:00","first_seen":"2023-08-17T20:15:10.553000+00:00","kev_first_seen":"2023-11-13T00:00:00+00:00","novelty_score":0.0,"novelty_reasons":[],"novelty_at":null,"vendors":["juniper"],"products":["ex2200","ex2200-c","ex2200-vc","ex2300","ex2300-24mp","ex2300-24p","ex2300-24t","ex2300-48mp","ex2300-48p","ex2300-48t","ex2300-c","ex2300m","ex3200","ex3300","ex3300-vc","ex3400","ex4200","ex4200-vc","ex4300","ex4300-24p","ex4300-24p-s","ex4300-24t","ex4300-24t-s","ex4300-32f","ex4300-32f-dc","ex4300-32f-s","ex4300-48mp","ex4300-48mp-s","ex4300-48p","ex4300-48p-s","ex4300-48t","ex4300-48t-afi","ex4300-48t-dc","ex4300-48t-dc-afi","ex4300-48t-s","ex4300-48tafi","ex4300-48tdc","ex4300-48tdc-afi","ex4300-mp","ex4300-vc","ex4300m","ex4400","ex4500","ex4500-vc","ex4550","ex4550-vc","ex4550\\/vc","ex4600","ex4600-vc","ex4650","ex6200","ex6210","ex8200","ex8200-vc","ex8208","ex8216","ex9200","ex9204","ex9208","ex9214","ex9250","ex9251","ex9253","junos"],"affected":[{"vendor":"juniper","product":"junos","ranges":["22.4","< 20.4","22.3","22.2","22.1","21.4","21.3","21.2","21.1","20.4"]}]}