Riskcovery

CVE-2022-22243

Junos OS: XPath Injection vulnerability in J-Web

State
Published
Severity
4.3 Medium
Published
Oct 18, 2022
Updated
May 9, 2025
Reserved
Dec 21, 2021

Read the record on cve.org

Description

An XPath Injection vulnerability due to Improper Input Validation in the J-Web component of Juniper Networks Junos OS allows an authenticated attacker to add an XPath command to the XPath stream, which may allow chaining to other unspecified vulnerabilities, leading to a partial loss of confidentiality. This issue affects Juniper Networks Junos OS: all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S2; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R2-S2, 21.3R3; 21.4 versions prior to 21.4R1-S2, 21.4R2-S1, 21.4R3; 22.1 versions prior to 22.1R1-S1, 22.1R2.

Scores

CVSSScoreVectorSource
3.14.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Njuniper

Weaknesses

  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
Junos OSJuniper Networks
  • before 19.1R3-S9Affected
  • 19.2 to before 19.2R3-S6Affected
  • 19.3 to before 19.3R3-S7Affected
  • 19.4 to before 19.4R2-S7, 19.4R3-S8Affected
  • 20.1 to before 20.1R3-S5Affected
  • 20.2 to before 20.2R3-S5Affected
  • 20.3 to before 20.3R3-S5Affected
  • 20.4 to before 20.4R3-S4Affected
  • 21.1 to before 21.1R3-S2Affected
  • 21.2 to before 21.2R3-S1Affected
  • 21.3 to before 21.3R2-S2, 21.3R3Affected
  • 21.4 to before 21.4R1-S2, 21.4R2-S1, 21.4R3Affected
  • 22.1 to before 22.1R1-S1, 22.1R2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.