---
id: "CVE-2023-36844"
kind: "vulnerability"
aliases: ["CVE-2023-36844"]
title: "juniper junos: A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an\u2026"
severity: "high"
cvss: 5.3
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Juniper Junos OS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": ["20.4"], "affected": "< 20.4", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 20.4", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 21.1", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 21.2", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 21.3", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 21.4", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 22.1", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 22.2", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 22.3", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 22.4", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 23.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ex-series", "exploited", "infrastructure", "juniper", "junos-os", "network-gear"]
not_affected_if: ["no-junos-os", "non-ex-series-hardware"]
published_at: "2023-08-17T20:15:10+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36844", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36844", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# juniper junos: A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an…

Juniper Junos OS on EX Series switches runs a PHP component that accepts crafted requests which overwrite certain PHP environment variables. An unauthenticated remote attacker can use this to partially compromise integrity and possibly chain it into further flaws.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Juniper Junos OS affected ? fixed ?
- vendor:juniper junos affected < 20.4 fixed 20.4
- vendor:juniper junos affected = 20.4 fixed ?
- vendor:juniper junos affected = 21.1 fixed ?
- vendor:juniper junos affected = 21.2 fixed ?
- vendor:juniper junos affected = 21.3 fixed ?
- vendor:juniper junos affected = 21.4 fixed ?
- vendor:juniper junos affected = 22.1 fixed ?
- vendor:juniper junos affected = 22.2 fixed ?
- vendor:juniper junos affected = 22.3 fixed ?
- vendor:juniper junos affected = 22.4 fixed ?
- vendor:juniper junos affected = 23.2 fixed ?

## Fix

Apply the mitigation or fixed Junos OS release from Juniper's advisory for CVE-2023-36844; CISA says to discontinue use of the product if no mitigation is available.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36844
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-36844

## From the sources

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.

Using a crafted request an attacker is able to modify 

certain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on EX Series:



  *  All versions prior to 20.4R3-S9;
  *  21.1 versions 21.1R1 and later;
  *  21.2 versions prior to 21.2R3-S7;
  *  21.3 versions 

prior to 

 21.3R3-S5;
  *  21.4 versions 

prior to 

21.4R3-S5;
  *  22.1 versions 

prior to 

22.1R3-S4;
  *  22.2 versions 

prior to 

22.2R3-S2;
  *  22.3 versions 

prior to 22.3R3-S1;
  *  22.4 versions 

prior to 

22.4R2-S2, 22.4R3;
  *  23.2 versions prior to 

23.2R1-S1, 23.2R2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_