CVE-2022-22244

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An XPath Injection vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker sending a crafted POST to reach the XPath channel, which may allow chaining to other unspecified vulnerabilities, leading to a partial loss of confidentiality. This issue affects Juniper Networks Junos OS: all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R3-S9; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S3; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R1-S2, 21.4R2; 22.1 versions prior to 22.1R1-S1, 22.1R2.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-91

Affected software

Vendor	Product	Versions
Juniper Networks	Junos OS	>= unspecified, < 19.1R3-S9; >= 19.2, < 19.2R3-S6; >= 19.3, < 19.3R3-S7; >= 19.4, < 19.4R3-S9; >= 20.1, < 20.1R3-S5; >= 20.2, < 20.2R3-S5; >= 20.3, < 20.3R3-S5; >= 20.4, < 20.4R3-S4; >= 21.1, < 21.1R3-S3; >= 21.2, < 21.2R3-S1; >= 21.3, < 21.3R3; >= 21.4, < 21.4R1-S2, 21.4R2; >= 22.1, < 22.1R1-S1, 22.1R2

References

https://kb.juniper.net/JSA69899Vendor Advisory
https://kb.juniper.net/JSA69899Vendor Advisory

Timeline

Published: Oct 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-222454.3A Path Traversal vulnerability in the J-Web component of Juniper Networks Junos OS allows an authenticated attacker to upload arbitrary file CVE-2022-222468.8A PHP Local File Inclusion (LFI) vulnerability in the J-Web component of Juniper Networks Junos OS may allow a low-privileged authenticated CVE-2022-222477.5An Improper Input Validation vulnerability in ingress TCP segment processing of Juniper Networks Junos OS Evolved allows a network-based una CVE-2022-222487.3An Incorrect Permission Assignment vulnerability in shell processing of Juniper Networks Junos OS Evolved allows a low-privileged local user CVE-2022-222496.5An Improper Control of a Resource Through its Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on M CVE-2022-22257.8By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zer CVE-2022-222506.5An Improper Control of a Resource Through its Lifetime vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS and Juno CVE-2022-222517.8On cSRX Series devices software permission issues in the container filesystem and stored files combined with storing passwords in a recovera CVE-2022-222527.5The DFX module has a UAF vulnerability.Successful exploitation of this vulnerability may affect system stability.CVE-2022-222537.5The DFX module has a vulnerability of improper validation of integrity check values.Successful exploitation of this vulnerability may affect CVE-2022-222547.5A permission bypass vulnerability exists when the NFC CAs access the TEE.Successful exploitation of this vulnerability may affect data confi CVE-2022-222557.5The application framework has a common DoS vulnerability.Successful exploitation of this vulnerability may affect the availability.