by Kastro
Paper/Archive/CVE-2023-28962

CVE-2023-28962

Juniper Networks Junos OS — Junos OS: Unauthenticated access vulnerability in J-Web

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 46.9.469 × 209.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An Improper Authentication vulnerability in upload-file.php, used by the J-Web component of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to upload arbitrary files to temporary folders on the device. This issue affects Juniper Networks Junos OS: All versions prior to 19.4R3-S11; 20.1 version 20.1R1 and later versions; 20.2 versions prior to 20.2R3-S7; 20.3 version 20.3R1 and later versions; 20.4 versions prior to 20.4R3-S6; 21.1 version 21.1R1 and later versions; 21.2 versions prior to 21.2R3-S4; 21.3 versions prior to 21.3R3-S3; 21.4 versions prior to 21.4R3-S3; 22.1 versions prior to 22.1R3-S1; 22.2 versions prior to 22.2R2-S1, 22.2R3; 22.3 versions prior to 22.3R1-S2, 22.3R2.

Affected

ProductAffectedFixed inSource
Junos OSunspecified – < 19.4R3-S1119.4R3-S11CNA
Junos OS20.1R1 – < 20.1*20.1*CNA
Junos OS20.2 – < 20.2R3-S720.2R3-S7CNA
Junos OS20.3R1 – < 20.3*20.3*CNA
Junos OS20.4 – < 20.4R3-S620.4R3-S6CNA
Junos OS21.1R1 – < 21.1*21.1*CNA
Junos OS21.2 – < 21.2R3-S421.2R3-S4CNA
Junos OS21.3 – < 21.3R3-S321.3R3-S3CNA
Junos OS21.4 – < 21.4R3-S321.4R3-S3CNA
Junos OS22.1 – < 22.1R3-S122.1R3-S1CNA
Junos OS22.2 – < 22.2R2-S1, 22.2R322.2R2-S1, 22.2R3CNA
Junos OS22.3 – < 22.3R1-S2, 22.3R222.3R1-S2, 22.3R2CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
juniper (CNA)5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refsupportportal.juniper.net/JSA70587