Junos OS (SRX firewalls)
CVE-2023-36844: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (EX Series) 0 | 20.4R3-S9 or later |
| Junos OS (EX Series) 21.1 | 21.1* or later |
| Junos OS (EX Series) 21.2 | 21.2R3-S6 or later |
| Junos OS (EX Series) 21.3 | 21.3R3-S5 or later |
| Junos OS (EX Series) 21.4 | 21.4R3-S5 or later |
| Junos OS (EX Series) 22.1 | 22.1R3-S4 or later |
| Junos OS (EX Series) 22.2 | 22.2R3-S2 or later |
| Junos OS (EX Series) 22.3 | 22.3R3-S1 or later |
| Junos OS (EX Series) 22.4 | 22.4R2-S2, 22.4R3 or later |
| Junos OS (EX Series) 23.2 | 23.2R1-S1, 23.2R2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.
Using a crafted request an attacker is able to modify
certain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on EX Series:
- All versions prior to 20.4R3-S9;
- 21.1 versions 21.1R1 and later;
- 21.2 versions prior to 21.2R3-S7;
- 21.3 versions
prior to
21.3R3-S5; * 21.4 versions
prior to
21.4R3-S5; * 22.1 versions
prior to
22.1R3-S4; * 22.2 versions
prior to
22.2R3-S2; * 22.3 versions
prior to 22.3R3-S1; * 22.4 versions
prior to
22.4R2-S2, 22.4R3; * 23.2 versions prior to
23.2R1-S1, 23.2R2.
Am I affected?
The following minimal configuration is necessary:
[system services web-management http]or
[system services web-management https]
Workarounds
Disable J-Web, or limit access to only trusted hosts.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
CISA lists this CVE as exploited in the wild since 13 Nov 2023.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.