Riskcovery

CVE-2023-36845

Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable

State
Published
Severity
9.8 Critical
Published
Aug 17, 2023
Updated
Oct 21, 2025
Reserved
Jun 27, 2023

Read the record on cve.org

Description

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series

and SRX Series

allows an unauthenticated, network-based attacker to remotely execute code.

Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code.

This issue affects Juniper Networks Junos OS on EX Series

and

SRX Series:

* All versions prior to

20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions

prior to

22.1R3-S4; * 22.2 versions

prior to

22.2R3-S2; * 22.3 versions

prior to

22.3R2-S2, 22.3R3-S1; * 22.4 versions

prior to

22.4R2-S1, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hjuniper

Weaknesses

  • CWE-473 PHP External Variable Modification

Affected Products

ProductVersions
Junos OSJuniper Networks
  • before 20.4R3-S9Affected
  • 21.1 to before 21.1*Affected
  • 21.2 to before 21.2R3-S7Affected
  • 21.3 to before 21.3R3-S5Affected
  • 21.4 to before 21.4R3-S5Affected
  • 22.1 to before 22.1R3-S4Affected
  • 22.2 to before 22.2R3-S2Affected
  • 22.3 to before 22.3R2-S2, 22.3R3-S1Affected
  • 22.4 to before 22.4R2-S1, 22.4R3Affected
  • 23,2 to before 23.2R1-S1, 23.2R2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.