An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device.
A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device. This issue is not exploitable from the Junos CLI. This issue affects Junos OS:
All versions before 21.2R3-S9, 21.4 versions before 21.4R3-S10, 22.2 versions before 22.2R3-S6, 22.4 versions before 22.4R3-S6, 23.2 versions before 23.2R2-S3, 23.4 versions before 23.4R2-S4, 24.2 versions before 24.2R1-S2, 24.2R2.
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
With a specific request to
webauthoperation.php
that doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of
integrity or confidentiality, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on SRX Series:
21.2 versions prior to 21.2R3-S8; 21.4
versions prior to
21.4R3-S6; 22.1
versions prior to
22.1R3-S5; 22.2
versions prior to
22.2R3-S3; 22.3
versions prior to
22.3R3-S2; 22.4 versions prior to 22,4R2-S2, 22.4R3; 23.2 versions prior to
23.2R1-S2, 23.2R2.
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
With a specific request to user.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of
integrity
for a certain
part of the file system, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on SRX Series:
All versions prior to 20.4R3-S8; 21.1 versions 21.1R1 and later; 21.2 versions prior to 21.2R3-S6; 21.3 versions
prior to
21.3R3-S5; 21.4 versions
prior to
21.4R3-S5; 22.1 versions
prior to
22.1R3-S3; 22.2 versions
prior to
22.2R3-S2; 22.3 versions
prior to
22.3R2-S2, 22.3R3; 22.4 versions
prior to
22.4R2-S1, 22.4R3.