CVE-2023-36845
Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability
CVSS
—
Sem CVSS
EPSS
95.1%
p100
KEV
SIM
13 de nov. de 2023
Exploit Today
80
0-100
Publicado: — · Última mod.: —
Produto
Juniper / Junos OS
Vulnerabilidade
Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability
Adicionado ao KEV
13 de nov. de 2023
Corrigir até
17 de nov. de 2023
Uso conhecido em ransomware
Não
Descrição resumida
Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.
Ação necessária
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notas
https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2023-36845