CVE-2022-22241

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An Improper Input Validation vulnerability in the J-Web component of Juniper Networks Junos OS may allow an unauthenticated attacker to access data without proper authorization. Utilizing a crafted POST request, deserialization may occur which could lead to unauthorized local file access or the ability to execute arbitrary commands. This issue affects Juniper Networks Junos OS: all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R2-S7, 19.4R3-S9; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S2; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R2-S2, 21.3R3; 21.4 versions prior to 21.4R1-S2, 21.4R2-S1, 21.4R3; 22.1 versions prior to 22.1R1-S1, 22.1R2.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20CWE-502

Affected software

VendorProductVersions
Juniper NetworksJunos OS>= unspecified, < 19.1R3-S9; >= 19.2, < 19.2R3-S6; >= 19.3, < 19.3R3-S7; >= 19.4, < 19.4R2-S7, 19.4R3-S9; >= 20.1, < 20.1R3-S5; >= 20.2, < 20.2R3-S5; >= 20.3, < 20.3R3-S5; >= 20.4, < 20.4R3-S4; >= 21.1, < 21.1R3-S2; >= 21.2, < 21.2R3-S1; >= 21.3, < 21.3R2-S2, 21.3R3; >= 21.4, < 21.4R1-S2, 21.4R2-S1, 21.4R3; >= 22.1, < 22.1R1-S1, 22.1R2

References

Timeline

Published
Oct 18, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-222426.1A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malCVE-2022-222434.3An XPath Injection vulnerability due to Improper Input Validation in the J-Web component of Juniper Networks Junos OS allows an authenticateCVE-2022-222445.3An XPath Injection vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker sending a crafted POCVE-2022-222454.3A Path Traversal vulnerability in the J-Web component of Juniper Networks Junos OS allows an authenticated attacker to upload arbitrary fileCVE-2022-222468.8A PHP Local File Inclusion (LFI) vulnerability in the J-Web component of Juniper Networks Junos OS may allow a low-privileged authenticated CVE-2022-222477.5An Improper Input Validation vulnerability in ingress TCP segment processing of Juniper Networks Junos OS Evolved allows a network-based unaCVE-2022-222487.3An Incorrect Permission Assignment vulnerability in shell processing of Juniper Networks Junos OS Evolved allows a low-privileged local userCVE-2022-222496.5An Improper Control of a Resource Through its Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MCVE-2022-22257.8By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured ZerCVE-2022-222506.5An Improper Control of a Resource Through its Lifetime vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS and JunoCVE-2022-222517.8On cSRX Series devices software permission issues in the container filesystem and stored files combined with storing passwords in a recoveraCVE-2022-222527.5The DFX module has a UAF vulnerability.Successful exploitation of this vulnerability may affect system stability.
CVE-2022-22241: Critical severity, CVSS 9.8 | Vulnix