{"id":"CVE-2023-36846","published":"2023-08-17T20:15:10Z","modified":"2026-06-17T06:07:12Z","title":"Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability","vendor":"Juniper","product":"Junos OS","tier":"core","eol":null,"description":{"text":"A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\nWith a specific request to user.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of \n\nintegrity\n\nfor a certain \n\npart of the file system, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on SRX Series:\n\n\n\n  *  All versions prior to 20.4R3-S8;\n  *  21.1 versions 21.1R1 and later;\n  *  21.2 versions prior to 21.2R3-S6;\n  *  21.3 versions \n\nprior to \n\n 21.3R3-S5;\n  *  21.4 versions \n\nprior to \n\n21.4R3-S5;\n  *  22.1 versions \n\nprior to \n\n22.1R3-S3;\n  *  22.2 versions \n\nprior to \n\n22.2R3-S2;\n  *  22.3 versions \n\nprior to \n\n22.3R2-S2, 22.3R3;\n  *  22.4 versions \n\nprior to \n\n22.4R2-S1, 22.4R3.","provenance":"source","from":"NVD"},"summary":{"text":"A Missing Authentication for Critical Function flaw in Juniper Networks Junos OS on SRX Series lets an attacker upload arbitrary files through J-Web by sending a specific request to user.php that requires no authentication. An unauthenticated attacker with network access can do this without any user interaction or special configuration, causing limited loss of file system integrity that may enable chaining to other vulnerabilities.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T12:59:24Z"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.93473,"percentile":0.99839,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2023-11-13","dueDate":"2023-11-17","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US ;  https://nvd.nist.gov/vuln/detail/CVE-2023-36846","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-08-29","exploitedFirstSeen":"2023-08-29","ransomware":false,"evidence":[{"url":"https://twitter.com/Shadowserver/status/1696512418036486246","date":"2023-08-29"},{"url":"https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution","date":"2023-11-08"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-11-13"},{"url":"https://www.cisa.gov/sites/default/files/2024-11/aa24-317a-2023-top-routinely-exploited-vulnerabilities.pdf","date":"2024-11-12"},{"url":"https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/2023-top-routinely-exploited-vulnerabilities","date":"2024-11-13"},{"url":"https://www.tenable.com/blog/verizon-2025-dbir-tenable-research-collaboration","date":"2025-04-23"},{"url":"https://www.verizon.com/business/resources/T32e/reports/2025-dbir-data-breach-investigations-report.pdf","date":"2025-04-25"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://supportportal.juniper.net/JSA72300","tags":["Vendor Advisory"]},{"url":"https://supportportal.juniper.net/JSA72300","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36846","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Missing Authentication","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited through a Missing Authentication for Critical Function weakness. Attackers leverage this vulnerability to impact file system integrity by sending a crafted request to the `user.php` endpoint, which does not require authentication. This manipulation allows the upload of arbitrary files, enabling attackers to chain this vulnerability with others, potentially leading to unauthenticated remote code execution.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Missing Authentication","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited through a Missing Authentication for Critical Function weakness. Attackers leverage this vulnerability to impact file system integrity by sending a crafted request to the `user.php` endpoint, which does not require authentication. This manipulation allows the upload of arbitrary files, enabling attackers to chain this vulnerability with others, potentially leading to unauthenticated remote code execution.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-40766","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-40766","exploited":true,"exploitedSince":"2023-11-13","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2023-08-29","earliestUrl":"https://github.com/Chocapikk/CVE-2023-36846","repos":[{"name":"Chocapikk/CVE-2023-36846","url":"https://github.com/Chocapikk/CVE-2023-36846","stars":5,"created":"2023-08-29"}]},"first":{"date":"2023-08-29","source":"PoC-in-GitHub","url":"https://github.com/Chocapikk/CVE-2023-36846"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2023-08-17","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36846","provenance":"source"},{"date":"2023-08-29","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Chocapikk/CVE-2023-36846","provenance":"source"},{"date":"2023-08-29","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://twitter.com/Shadowserver/status/1696512418036486246","provenance":"source"},{"date":"2023-11-13","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-11-13","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-40766","provenance":"source"}],"speed":{"daysToPublicExploit":12,"firstExploitFrom":"PoC-in-GitHub","daysToKev":88},"priority":{"score":63.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1160 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9984"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.71,"detail":"base score 5.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}