CVE-2022-22245
Last modified
CVE-2022-22245 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. A Path Traversal vulnerability in the J-Web component of Juniper Networks Junos OS allows an authenticated attacker to upload arbitrary files to the device by bypassing validation checks built into Junos OS. The attacker should not be able to execute the file due to validation checks built into Junos OS. EPSS estimates a 0.62% chance of exploitation in the next 30 days.
Description
A Path Traversal vulnerability in the J-Web component of Juniper Networks Junos OS allows an authenticated attacker to upload arbitrary files to the device by bypassing validation checks built into Junos OS. The attacker should not be able to execute the file due to validation checks built into Junos OS. Successful exploitation of this vulnerability could lead to loss of filesystem integrity. This issue affects Juniper Networks Junos OS: all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R3-S9; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S2; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R2-S2, 21.3R3; 21.4 versions prior to 21.4R1-S2, 21.4R2-S1, 21.4R3; 22.1 versions prior to 22.1R1-S1, 22.1R2.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Juniper | Junos | < 19.1 | — |
| Juniper | Junos | 19.1 | — |
| Juniper | Junos | 19.2 | — |
| Juniper | Junos | 19.3 | — |
| Juniper | Junos | 19.4 | — |
| Juniper | Junos | 20.1 | — |
| Juniper | Junos | 20.2 | — |
| Juniper | Junos | 20.3 | — |
| Juniper | Junos | 20.4 | — |
| Juniper | Junos | 21.1 | — |
| Juniper | Junos | 21.2 | — |
| Juniper | Junos | 21.3 | — |
| Juniper | Junos | 21.4 | — |
| Juniper | Junos | 22.1 | R1 |
References
- https://kb.juniper.net/JSA69899Vendor Advisory
- https://kb.juniper.net/JSA69899Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-22245?
How severe is CVE-2022-22245?
How do I fix CVE-2022-22245?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-2224The WordPress plugin Gallery for Social Photo is vulnerable …4.3
- CVE-2022-22240An Allocation of Resources Without Limits or Throttling and …5.5
- CVE-2022-22241An Improper Input Validation vulnerability in the J-Web comp…9.8
- CVE-2022-22242A Cross-site Scripting (XSS) vulnerability in the J-Web comp…6.1
- CVE-2022-22243An XPath Injection vulnerability due to Improper Input Valid…4.3
- CVE-2022-22244An XPath Injection vulnerability in the J-Web component of J…5.3
- CVE-2022-22246A PHP Local File Inclusion (LFI) vulnerability in the J-Web …8.8
- CVE-2022-22247An Improper Input Validation vulnerability in ingress TCP se…7.5
- CVE-2022-22248An Incorrect Permission Assignment vulnerability in shell pr…7.3
- CVE-2022-22249An Improper Control of a Resource Through its Lifetime vulne…6.5
- CVE-2022-2225By using warp-cli subcommands (disable-ethernet, disable-wif…7.8
- CVE-2022-22250An Improper Control of a Resource Through its Lifetime vulne…6.5
Are you affected by CVE-2022-22245?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST