Juniper Junos OS Pre-Auth RCE (JSA72300)

medium Nessus Plugin ID 186695

Language:

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX and SRX Series allows an unauthenticated, network-based attacker to control certain, important environments variables. Utilizing a crafted request an attacker is able to modify certain PHP environments variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities.

Solution

Apply the relevant Junos software release referenced in Juniper advisory JSA72300

Plugin Details

Severity: Medium

ID: 186695

File Name: junos_cve-2023-36844.nbin

Version: 1.9

Type: remote

Family: Misc.

Published: 12/8/2023

Updated: 4/23/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 2.9

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2023-36844

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:juniper:junos

Required KB Items: installed_sw/Junos J-Web

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 8/17/2023

Vulnerability Publication Date: 8/17/2023

CISA Known Exploited Vulnerability Due Dates: 11/17/2023

Reference Information

CVE: CVE-2023-36844

IAVA: 2023-A-0465

JSA: JSA72300

Detections

Analytics