Is CVE-2023-36845 exploitable?

Yes — CVE-2023-36845 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it is confirmed exploited in the wild.

Is CVE-2023-36845 a false positive?

No practitioners have marked CVE-2023-36845 a false positive so far (2 verdicts).

How do I remediate CVE-2023-36845?

See the authoritative references (NVD, vendor advisory) and community field notes on this page for remediation guidance.

CVE-2023-36845

is CVE-2023-36845real, exploitable, or a false positive? Here's the community ground truth.

☆ Watch

Critical · CVSS 9.8EPSS 93.5%CISA KEVCWE-473

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code. This issue affects Juniper Networks Junos OS on EX Series and SRX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R2-S2, 22.3R3-S1; * 22.4 versions prior to 22.4R2-S1, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.

References

NVD MITRE CVE.org CISA KEV

Published Aug 17, 2023

Embed this verdict

Markdown

[![TruePositive verdict](https://www.truepositive.app/cve/CVE-2023-36845/badge.svg)](https://www.truepositive.app/cve/CVE-2023-36845)

HTML

<a href="https://www.truepositive.app/cve/CVE-2023-36845"><img src="https://www.truepositive.app/cve/CVE-2023-36845/badge.svg" alt="TruePositive verdict for CVE-2023-36845"></a>

Live badge — updates automatically as the community verdict changes.

Community ground truth

Community verdict

2 verdicts

Not a real issue

Includes TruePositive's curated baseline from public sources — community verdicts accrue on top.

to add your verdict.

Community real-world severity: Critical (Critical 2) — CVSS base score 9.8

In line with its CVSS base score.

Field notes & remediation

Verdicts are the quick signal — notes are the evidence and fixes behind them.

0
Field note · Diego RamírezCurated
Confirmed exploited in the wild — listed in the CISA KEV catalog (added 2023-11-13). Treat as real and prioritize patching over triage.

Same weakness — CWE-473.

CVE-2023-36844CVSS 5.3KEVEPSS 90%
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on EX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R3-S1; * 22.4 versions prior to 22.4R2-S2, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.

CVE-2023-36845

Community ground truth

Field notes & remediation

Related CVEs