{"history":[{"alert":0,"cve":"CVE-2023-36851","id":22524,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.01123, \"percentile\": 0.667}"},{"alert":0,"cve":"CVE-2023-36851","id":20143,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.01123, \"percentile\": 0.66515}"},{"alert":0,"cve":"CVE-2023-36851","id":18109,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.01123, \"percentile\": 0.66475}"},{"alert":0,"cve":"CVE-2023-36851","id":16173,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.01123, \"percentile\": 0.6646}"},{"alert":0,"cve":"CVE-2023-36851","id":14151,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.01123, \"percentile\": 0.6644}"},{"alert":0,"cve":"CVE-2023-36851","id":11933,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.01123, \"percentile\": 0.6639}"},{"alert":0,"cve":"CVE-2023-36851","id":9919,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.01123, \"percentile\": 0.66366}"},{"alert":0,"cve":"CVE-2023-36851","id":7467,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.01123, \"percentile\": 0.66343}"},{"alert":1,"cve":"CVE-2023-36851","id":6244,"kind":"cna","observed_at":1793809200,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2024-08-02T17:01:09.845Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"tags\": [\"vendor-advisory\", \"mitigation\", \"x_transferred\"], \"url\": \"https://supportportal.juniper.net/JSA72300\"}], \"title\": \"CVE Program Container\"}, {\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2023-36851\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2023-11-15T16:40:42.428099Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2023-11-13\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36851\"}, \"type\": \"kev\"}}], \"providerMetadata\": {\"dateUpdated\": \"2025-10-21T23:05:36.801Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36851\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2023-11-13T00:00:00.000Z\", \"value\": \"CVE-2023-36851 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"platforms\": [\"SRX Series\"], \"product\": \"Junos OS\", \"vendor\": \"Juniper Networks\", \"versions\": [{\"lessThan\": \"21.2R3-S8\", \"status\": \"affected\", \"version\": \"21.2\", \"versionType\": \"semver\"}, {\"lessThan\": \"21.4R3-S6\", \"status\": \"affected\", \"version\": \"21.4\", \"versionType\": \"semver\"}, {\"lessThan\": \"22.1R3-S5\", \"status\": \"affected\", \"version\": \"22.1\", \"versionType\": \"semver\"}, {\"lessThan\": \"22.2R3-S3\", \"status\": \"affected\", \"version\": \"22.2\", \"versionType\": \"semver\"}, {\"lessThan\": \"22.3R3-S2\", \"status\": \"affected\", \"version\": \"22.3\", \"versionType\": \"semver\"}, {\"lessThan\": \"22.4R2-S2, 22.4R3\", \"status\": \"affected\", \"version\": \"22.4\", \"versionType\": \"semver\"}, {\"lessThan\": \"23.2R1-S2, 23.2R2\", \"status\": \"affected\", \"version\": \"23.2\", \"versionType\": \"semver\"}]}], \"configurations\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"

The following minimal configuration is necessary:

  [system services web-management http]

or

  [system services web-management https]
\"}], \"value\": \"The following minimal configuration is necessary:\\n\\n\\u00a0 [system services web-management http]or\\n\\n\\u00a0 [system services web-management https]\"}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"The Juniper SIRT would like to acknowledge and thank watchtowr for responsibly reporting this vulnerability.\"}], \"datePublic\": \"2023-09-05T19:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.

\\n\\nWith a specific request to \\n\\nwebauth_operation.php\\n\\nthat doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of \\n\\nintegrity or confidentiality, which may allow chaining to other vulnerabilities.\\n\\n

This issue affects Juniper Networks Junos OS on SRX Series:

\"}], \"value\": \"A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\\n\\n\\n\\nWith a specific request to \\n\\nwebauth_operation.php\\n\\nthat doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of \\n\\nintegrity\\u00a0or confidentiality, which may allow chaining to other vulnerabilities.\\n\\n\\nThis issue affects Juniper Networks Junos OS on SRX Series:\\n\\n\\n\\n * \\n\\n21.2 versions prior to 21.2R3-S8;\\n * 21.4 \\n\\nversions prior to \\n\\n21.4R3-S6;\\n * 22.1 \\n\\nversions prior to \\n\\n22.1R3-S5;\\n * 22.2 \\n\\nversions prior to \\n\\n22.2R3-S3;\\n * 22.3 \\n\\nversions prior to \\n\\n22.3R3-S2;\\n * 22.4 versions prior to 22,4R2-S2, 22.4R3;\\n * 23.2 versions prior to \\n\\n23.2R1-S2,\\u00a023.2R2.\"}], \"exploits\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"While Juniper SIRT is not aware of a successful exploit against a customer, a proof of concept has been published and exploit attempts have been detected.\\n\\n
\"}], \"value\": \"While Juniper SIRT is not aware of a successful exploit against a customer, a proof of concept has been published and exploit attempts have been detected.\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-306\", \"description\": \"CWE-306 Missing Authentication for Critical Function\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2024-01-25T22:36:32.697Z\", \"orgId\": \"8cbe9d5a-a066-4c94-8978-4b15efeae968\", \"shortName\": \"juniper\"}, \"references\": [{\"tags\": [\"vendor-advisory\", \"mitigation\"], \"url\": \"https://supportportal.juniper.net/JSA72300\"}], \"solutions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"The following software releases have been updated to resolve this specific issue: 21.2R3-S8*, 21.4R3-S6*, 22.1R3-S5*, 22.2R3-S3*, 22.3R3-S2*, 22.4R2-S2, 22.4R3*, 23.2R1-S2, 23.2R2*, 23.4R1, and all subsequent releases.
*Pending Publication
\"}], \"value\": \"The following software releases have been updated to resolve this specific issue:\\u00a021.2R3-S8*, 21.4R3-S6*, 22.1R3-S5*, 22.2R3-S3*, 22.3R3-S2*, 22.4R2-S2, 22.4R3*, 23.2R1-S2, 23.2R2*, 23.4R1,\\u00a0and all subsequent releases.\\n*Pending Publication\"}], \"source\": {\"advisory\": \"JSA72300\", \"defect\": [\"1758332\"], \"discovery\": \"EXTERNAL\"}, \"timeline\": [{\"lang\": \"en\", \"time\": \"2023-09-05T19:00:00.000Z\", \"value\": \"Initial CVE publication\"}, {\"lang\": \"en\", \"time\": \"2023-11-08T17:00:00.000Z\", \"value\": \"Juniper SIRT is now aware of successful exploitation\"}], \"title\": \"Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files\", \"workarounds\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"Disable J-Web, or limit access to only trusted hosts.
\"}], \"value\": \"Disable J-Web, or limit access to only trusted hosts.\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}}}, \"cveMetadata\": {\"assignerOrgId\": \"8cbe9d5a-a066-4c94-8978-4b15efeae968\", \"assignerShortName\": \"juniper\", \"cveId\": \"CVE-2023-36851\", \"datePublished\": \"2023-09-26T19:53:17.080Z\", \"dateReserved\": \"2023-06-27T16:17:25.277Z\", \"dateUpdated\": \"2025-10-21T23:05:36.801Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.1\"}"},{"alert":0,"cve":"CVE-2023-36851","id":5244,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.01123, \"percentile\": 0.66289}"},{"alert":0,"cve":"CVE-2023-36851","id":3026,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.01123, \"percentile\": 0.66253}"},{"alert":1,"cve":"CVE-2023-36851","id":739,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2023-36851\", \"cwes\": [\"CWE-306\"], \"dateAdded\": \"2023-11-13\", \"dueDate\": \"2023-11-17\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Unknown\", \"notes\": \"https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2023-36851\", \"product\": \"Junos OS\", \"requiredAction\": \"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\", \"shortDescription\": \"Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.\", \"vendorProject\": \"Juniper\", \"vulnerabilityName\": \"Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability\"}"}],"record":{"affected":[{"defaultStatus":"unaffected","platforms":["SRX Series"],"product":"Junos OS","vendor":"Juniper Networks","versions":[{"lessThan":"21.2R3-S8","status":"affected","version":"21.2","versionType":"semver"},{"lessThan":"21.4R3-S6","status":"affected","version":"21.4","versionType":"semver"},{"lessThan":"22.1R3-S5","status":"affected","version":"22.1","versionType":"semver"},{"lessThan":"22.2R3-S3","status":"affected","version":"22.2","versionType":"semver"},{"lessThan":"22.3R3-S2","status":"affected","version":"22.3","versionType":"semver"},{"lessThan":"22.4R2-S2, 22.4R3","status":"affected","version":"22.4","versionType":"semver"},{"lessThan":"23.2R1-S2, 23.2R2","status":"affected","version":"23.2","versionType":"semver"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-02T17:01:09.845Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["vendor-advisory","mitigation","x_transferred"],"url":"https://supportportal.juniper.net/JSA72300"}],"title":"CVE Program Container"},{"metrics":[{"other":{"content":{"id":"CVE-2023-36851","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2023-11-15T16:40:42.428099Z","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2023-11-13","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36851"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2025-10-21T23:05:36.801Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36851"}],"timeline":[{"lang":"en","time":"2023-11-13T00:00:00.000Z","value":"CVE-2023-36851 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","platforms":["SRX Series"],"product":"Junos OS","vendor":"Juniper Networks","versions":[{"lessThan":"21.2R3-S8","status":"affected","version":"21.2","versionType":"semver"},{"lessThan":"21.4R3-S6","status":"affected","version":"21.4","versionType":"semver"},{"lessThan":"22.1R3-S5","status":"affected","version":"22.1","versionType":"semver"},{"lessThan":"22.2R3-S3","status":"affected","version":"22.2","versionType":"semver"},{"lessThan":"22.3R3-S2","status":"affected","version":"22.3","versionType":"semver"},{"lessThan":"22.4R2-S2, 22.4R3","status":"affected","version":"22.4","versionType":"semver"},{"lessThan":"23.2R1-S2, 23.2R2","status":"affected","version":"23.2","versionType":"semver"}]}],"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

The following minimal configuration is necessary:

  [system services web-management http]

or

  [system services web-management https]
"}],"value":"The following minimal configuration is necessary:\n\n\u00a0 [system services web-management http]or\n\n\u00a0 [system services web-management https]"}],"credits":[{"lang":"en","type":"finder","value":"The Juniper SIRT would like to acknowledge and thank watchtowr for responsibly reporting this vulnerability."}],"datePublic":"2023-09-05T19:00:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.

\n\nWith a specific request to \n\nwebauth_operation.php\n\nthat doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of \n\nintegrity or confidentiality, which may allow chaining to other vulnerabilities.\n\n

This issue affects Juniper Networks Junos OS on SRX Series:

"}],"value":"A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\nWith a specific request to \n\nwebauth_operation.php\n\nthat doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of \n\nintegrity\u00a0or confidentiality, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on SRX Series:\n\n\n\n * \n\n21.2 versions prior to 21.2R3-S8;\n * 21.4 \n\nversions prior to \n\n21.4R3-S6;\n * 22.1 \n\nversions prior to \n\n22.1R3-S5;\n * 22.2 \n\nversions prior to \n\n22.2R3-S3;\n * 22.3 \n\nversions prior to \n\n22.3R3-S2;\n * 22.4 versions prior to 22,4R2-S2, 22.4R3;\n * 23.2 versions prior to \n\n23.2R1-S2,\u00a023.2R2."}],"exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"While Juniper SIRT is not aware of a successful exploit against a customer, a proof of concept has been published and exploit attempts have been detected.\n\n
"}],"value":"While Juniper SIRT is not aware of a successful exploit against a customer, a proof of concept has been published and exploit attempts have been detected."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2024-01-25T22:36:32.697Z","orgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","shortName":"juniper"},"references":[{"tags":["vendor-advisory","mitigation"],"url":"https://supportportal.juniper.net/JSA72300"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The following software releases have been updated to resolve this specific issue: 21.2R3-S8*, 21.4R3-S6*, 22.1R3-S5*, 22.2R3-S3*, 22.3R3-S2*, 22.4R2-S2, 22.4R3*, 23.2R1-S2, 23.2R2*, 23.4R1, and all subsequent releases.
*Pending Publication
"}],"value":"The following software releases have been updated to resolve this specific issue:\u00a021.2R3-S8*, 21.4R3-S6*, 22.1R3-S5*, 22.2R3-S3*, 22.3R3-S2*, 22.4R2-S2, 22.4R3*, 23.2R1-S2, 23.2R2*, 23.4R1,\u00a0and all subsequent releases.\n*Pending Publication"}],"source":{"advisory":"JSA72300","defect":["1758332"],"discovery":"EXTERNAL"},"timeline":[{"lang":"en","time":"2023-09-05T19:00:00.000Z","value":"Initial CVE publication"},{"lang":"en","time":"2023-11-08T17:00:00.000Z","value":"Juniper SIRT is now aware of successful exploitation"}],"title":"Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Disable J-Web, or limit access to only trusted hosts.
"}],"value":"Disable J-Web, or limit access to only trusted hosts."}],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}}},"cveMetadata":{"assignerOrgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","assignerShortName":"juniper","cveId":"CVE-2023-36851","datePublished":"2023-09-26T19:53:17.080Z","dateReserved":"2023-06-27T16:17:25.277Z","dateUpdated":"2025-10-21T23:05:36.801Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"cna_checked":1794241201,"cve":"CVE-2023-36851","description":"A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.\n\n\n\nWith a specific request to \n\nwebauth_operation.php\n\nthat doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of \n\nintegrity\u00a0or confidentiality, which may allow chaining to other vulnerabilities.\n\n\nThis issue affects Juniper Networks Junos OS on SRX Series:\n\n\n\n * \n\n21.2 versions prior to 21.2R3-S8;\n * 21.4 \n\nversions prior to \n\n21.4R3-S6;\n * 22.1 \n\nversions prior to \n\n22.1R3-S5;\n * 22.2 \n\nversions prior to \n\n22.2R3-S3;\n * 22.3 \n\nversions prior to \n\n22.3R3-S2;\n * 22.4 versions prior to 22,4R2-S2, 22.4R3;\n * 23.2 versions prior to \n\n23.2R1-S2,\u00a023.2R2.","epss":{"date":"2026-11-12","epss":0.01123,"percentile":0.667},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2023-36851","cwes":["CWE-306"],"dateAdded":"2023-11-13","dueDate":"2023-11-17","forensicTriage":"No","knownRansomwareCampaignUse":"Unknown","notes":"https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2023-36851","product":"Junos OS","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","shortDescription":"Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.","vendorProject":"Juniper","vulnerabilityName":"Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability"},"kev_checked":1794522003,"products":"Juniper Networks Junos OS","references":["https://supportportal.juniper.net/JSA72300","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36851"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","provider":"juniper","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"solutions":"The following software releases have been updated to resolve this specific issue:\u00a021.2R3-S8*, 21.4R3-S6*, 22.1R3-S5*, 22.2R3-S3*, 22.3R3-S2*, 22.4R2-S2, 22.4R3*, 23.2R1-S2, 23.2R2*, 23.4R1,\u00a0and all subsequent releases.\n*Pending Publication","state":"PUBLISHED","title":"Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files","updated_at":1794500401,"workarounds":"Disable J-Web, or limit access to only trusted hosts."},"sources":[]}