CVE-2023-36844
Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.
Using a crafted request an attacker is able to modify
certain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on EX Series:
- All versions prior to 20.4R3-S9;
- 21.1 versions 21.1R1 and later;
- 21.2 versions prior to 21.2R3-S7;
- 21.3 versions
prior to
21.3R3-S5;
- 21.4 versions
prior to
21.4R3-S5;
- 22.1 versions
prior to
22.1R3-S4;
- 22.2 versions
prior to
22.2R3-S2;
- 22.3 versions
prior to 22.3R3-S1;
- 22.4 versions
prior to
22.4R2-S2, 22.4R3;
- 23.2 versions prior to
23.2R1-S1, 23.2R2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.
Using a crafted request an attacker is able to modify
certain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on EX Series:
- All versions prior to 20.4R3-S9;
- 21.1 versions 21.1R1 and later;
- 21.2 versions prior to 21.2R3-S7;
- 21.3 versions
prior to
21.3R3-S5;
- 21.4 versions
prior to
21.4R3-S5;
- 22.1 versions
prior to
22.1R3-S4;
- 22.2 versions
prior to
22.2R3-S2;
- 22.3 versions
prior to 22.3R3-S1;
- 22.4 versions
prior to
22.4R2-S2, 22.4R3;
- 23.2 versions prior to
23.2R1-S1, 23.2R2.
- Record
CVE-2023-36844- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-473
- Updated
- 2026-11-02
EUVDEUVD-2023-40764
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.
Using a crafted request an attacker is able to modify
certain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on EX Series:
- All versions prior to 20.4R3-S9;
- 21.1 versions 21.1R1 and later;
- 21.2 versions prior to 21.2R3-S7;
- 21.3 versions
prior to
21.3R3-S5;
- 21.4 versions
prior to
21.4R3-S5;
- 22.1 versions
prior to
22.1R3-S4;
- 22.2 versions
prior to
22.2R3-S2;
- 22.3 versions
prior to 22.3R3-S1;
- 22.4 versions
prior to
22.4R2-S2, 22.4R3;
- 23.2 versions prior to
23.2R1-S1, 23.2R2.
- Record
EUVD-2023-40764- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f2v8-3pfh-v3xm
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX...
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environments variables.
Utilizing a crafted request an attacker is able to modify
certain PHP environments variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on EX Series:
- All versions prior to 20.4R3-S9;
- 21.2 versions prior to 21.2R3-S6;
- 21.3 versions
prior to
21.3R3-S5;
- 21.4 versions
prior to
21.4R3-S5;
- 22.1 versions
prior to
22.1R3-S4;
- 22.2 versions
prior to
22.2R3-S2;
- 22.3 versions
prior to 22.3R3-S1;
- 22.4 versions
prior to
22.4R2-S2, 22.4R3.
- Record
GHSA-f2v8-3pfh-v3xm- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-473
- Updated
- 2026-11-02
CISA KEV No score
Juniper Junos OS EX Series PHP External Variable Modification Vulnerability
Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities.
- Record
CVE-2023-36844- Weakness
- CWE-473
- Updated
- 2026-11-02
NVD
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.
Using a crafted request an attacker is able to modify
certain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on EX Series:
- All versions prior to 20.4R3-S9;
- 21.1 versions 21.1R1 and later;
- 21.2 versions prior to 21.2R3-S7;
- 21.3 versions
prior to
21.3R3-S5;
- 21.4 versions
prior to
21.4R3-S5;
- 22.1 versions
prior to
22.1R3-S4;
- 22.2 versions
prior to
22.2R3-S2;
- 22.3 versions
prior to 22.3R3-S1;
- 22.4 versions
prior to
22.4R2-S2, 22.4R3;
- 23.2 versions prior to
23.2R1-S1, 23.2R2.
- Record
CVE-2023-36844- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-473
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Junos OS PHPRC Environment Variable Manipulation RCE | 2023-08-17 |
| PoC in GitHub | watchtowrlabs/juniper-rce_cve-2023-36844 | 2023-08-25 |
| PoC in GitHub | Ap0dexMe0/CVE-2023-36844 | 2023-09-20 |
| PoC in GitHub | r3dcl1ff/CVE-2023-36844_Juniper_RCE | 2023-09-24 |
| Nuclei | Juniper Devices - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-36844 is a medium vulnerability (CVSS 5.3) in Juniper Junos, published August 17, 2023. CISA lists it as known to be exploited, since November 13, 2023. EUVD reports exploitation since November 13, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 90.0%, the 99th percentile. No source names a fixed version.
References
supportportal.juniper.net/JSA72300
packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36844
nvd.nist.gov/vuln/detail/CVE-2023-36844
github.com/advisories/GHSA-f2v8-3pfh-v3xm