CVE-2023-36844

Confirmed PUBLISHED

Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables

Juniper Networks · Junos OS

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

5.3 Medium EPSS 89.6%

At a Glance

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on EX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R3-S1; * 22.4 versions prior to 22.4R2-S2, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.

php edge cisa nuclei_scanner

CVE Published: Aug 17, 2023
Exploitation Reported: Nov 13, 2023
CVSS: 5.3 Medium
EPSS: 89.6%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Juniper Networks	Junos OS	0 to < 20.4R3-S9	Affected
Juniper Networks	Junos OS	21.1 to < 21.1*	Affected
Juniper Networks	Junos OS	21.2 to < 21.2R3-S6	Affected
Juniper Networks	Junos OS	21.3 to < 21.3R3-S5	Affected
Juniper Networks	Junos OS	21.4 to < 21.4R3-S5	Affected
Juniper Networks	Junos OS	22.1 to < 22.1R3-S4	Affected
Juniper Networks	Junos OS	22.2 to < 22.2R3-S2	Affected
Juniper Networks	Junos OS	22.3 to < 22.3R3-S1	Affected
Juniper Networks	Junos OS	22.4 to < 22.4R2-S2, 22.4R3	Affected
Juniper Networks	Junos OS	23.2 to < 23.2R1-S1, 23.2R2	Affected

CVE References

Vendor Advisory — supportportal.juniper.net supportportal.juniper.net · Vendor Advisory https://supportportal.juniper.net/JSA72300
packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-S...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2023-11-13 00:00 UTC
The Shadowserver	2026-05-29 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36844.yaml	Apr 25, 2025

CVSS Scores

CVSS v3.1 5.3 Medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitation Status

Exploited in the wild

Recorded 2023-11-13 00:00:00 UTC · CISA

Proof of concept available

Recorded 2023-09-24 13:30:09 UTC · GitHub

Weaknesses (CWE)

CWE-473

PHP External Variable Modification

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36844.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

r3dcl1ff/CVE-2023-36844_Juniper_RCE

github · Created 2023-09-24 13:30:09 UTC · 5 stars

A Proof of Concept for chaining the CVEs [CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, CVE-2023-36847] to achieve Remote Code Execution (phpinfo) in Juniper JunOS within SRX and EX Series products.Modified from original exploit developed by @watchTowr .

Juniper Devices - Remote Code Execution

nuclei · Created Unknown

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2023-36844

{
  "cve_id": "CVE-2023-36844",
  "title": "Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated a...",
  "affected_vendor": "Juniper Networks",
  "affected_product": "Junos OS",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 5.3,
  "epss_score": 0.89628,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2023-36844

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API