High severity · published Oct 19, 2021
CVE-2021-0296
The Juniper Networks CTPView server is not enforcing HTTP Strict Transport Security (HSTS)
7.4
CVSS
0.5%
EPSS
No
On KEV
Description
The Juniper Networks CTPView server is not enforcing HTTP Strict Transport Security (HSTS). HSTS is an optional response header which allows servers to indicate that content from the requested domain will only be served over HTTPS. The lack of HSTS may leave the system vulnerable to downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections. This issue affects Juniper Networks CTPView: 7.3 versions prior to 7.3R7; 9.1 versions prior to 9.1R3.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CT
Ctpview · Juniper
7.3; 7.3; 7.3; 7.3; 7.3; 7.3; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-0296
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-0296
Vendor Advisory
https://kb.juniper.net/JSA11210
More from Ctpview
7.8
CVE-2009-0115
The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly…
–
CVE-2009-1185
udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space