CVE-2022-22246: Junos OS: PHP file inclusion vulnerability in J-Web
A PHP Local File Inclusion (LFI) vulnerability in the J-Web component of Juniper Networks Junos OS may allow a low-privileged authenticated attacker to execute an untrusted PHP file. By chaining this vulnerability with other unspecified vulnerabilities, and by circumventing existing attack requirements, successful exploitation could lead to a complete system compromise. This issue affects Juniper Networks Junos OS: all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S6; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S2; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R2-S2, 21.3R3; 21.4 versions prior to 21.4R1-S2, 21.4R2-S1, 21.4R3; 22.1 versions prior to 22.1R1-S1, 22.1R2.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-22246?
CVE-2022-22246 is classified as a medium-severity vulnerability.
How do I fix CVE-2022-22246?
To fix CVE-2022-22246, update to the latest Junos OS version that addresses the vulnerability.
What systems are affected by CVE-2022-22246?
CVE-2022-22246 affects multiple versions of Junos OS up to version 19.1.
Can CVE-2022-22246 be exploited remotely?
CVE-2022-22246 requires low-privileged authenticated access, so it cannot be exploited remotely without proper credentials.
What type of vulnerability is CVE-2022-22246?
CVE-2022-22246 is classified as a PHP Local File Inclusion (LFI) vulnerability.