CVE-2021-0296— CTPView: HSTS not being enforced on CTPView server.
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-0296
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CTPView: HSTS not being enforced on CTPView server.
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Juniper Networks CTPView server is not enforcing HTTP Strict Transport Security (HSTS). HSTS is an optional response header which allows servers to indicate that content from the requested domain will only be served over HTTPS. The lack of HSTS may leave the system vulnerable to downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections. This issue affects Juniper Networks CTPView: 7.3 versions prior to 7.3R7; 9.1 versions prior to 9.1R3.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
敏感数据的明文传输
Source: NVD (National Vulnerability Database)
Vulnerability Title
Juniper Networks CtpView输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Juniper Networks CtpView是美国Juniper Networks公司的一个网络管理系统。用于管理人员能够在监控网络的同时部署电路。 CTPView server 中存在输入验证错误漏洞，该漏洞源于产品未执行HSTS检测方法。攻击者可通过该漏洞执行ssl剥离中间人攻击、降级攻击和弱cookie劫持保护。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Juniper Networks | CTPView | 7.3 ~ 7.3R7 | - |
II. Public POCs for CVE-2021-0296
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-0296
请登录查看更多情报信息。
Same Patch Batch · Juniper Networks · 2021-10-19 · 42 CVEs total
| CVE-2021-31349 | 9.8 CRITICAL | Session Smart Router: Authentication Bypass Vulnerability |
| CVE-2021-31385 | 8.8 HIGH | Junos OS: J-Web: A path traversal vulnerability allows an authenticated attacker to elevat |
| CVE-2021-31372 | 8.8 HIGH | Junos OS: J-Web allows a locally authenticated attacker to escalate their privileges to ro |
| CVE-2021-31355 | 8.0 HIGH | Junos OS: Stored Cross-Site Scripting (XSS) vulnerability in captive portal |
| CVE-2021-31373 | 8.0 HIGH | Junos OS: SRX Series: Persistent XSS vulnerability in J-Web |
| CVE-2021-31359 | 7.8 HIGH | Junos OS and Junos OS Evolved: Local Privilege Escalation vulnerability |
| CVE-2021-31358 | 7.8 HIGH | Junos OS Evolved: shell-injection vulnerabilities in evo_sftp UI wrapper script |
| CVE-2021-31357 | 7.8 HIGH | Junos OS Evolved: shell-injection vulnerabilities in evo_tcpdump UI wrapper script |
| CVE-2021-31356 | 7.8 HIGH | Junos OS Evolved: Multiple shell-injection vulnerabilities in EVO UI wrapper scripts |
| CVE-2021-31374 | 7.5 HIGH | Junos OS and Junos OS Evolved: RPD crash while processing a specially crafted BGP UPDATE o |
| CVE-2021-31368 | 7.5 HIGH | Junos OS: EX2300 Series, EX3400 Series, and ACX710 might become unresponsive if the out-of |
| CVE-2021-31353 | 7.5 HIGH | Junos OS and Junos OS Evolved: RPD core upon receipt of specific BGP update |
| CVE-2021-31376 | 7.5 HIGH | Junos OS: ACX Series: Packet Forwarding Engine manager (FXPC) process crashes when process |
| CVE-2021-31351 | 7.5 HIGH | Junos OS: MX Series: Receipt of specific packet on MS-MPC/MS-MIC causes line card reset |
| CVE-2021-31379 | 7.5 HIGH | Junos OS: MX Series: MPC 7/8/9/10/11 cards with MAP-E: PFE halts when an attacker sends ma |
| CVE-2021-31350 | 7.5 HIGH | Junos OS and Junos OS Evolved: Privilege escalation vulnerability in Juniper Extension Too |
| CVE-2021-0299 | 7.5 HIGH | Junos OS: Kernel crash (vmcore) upon receipt of a malformed IPv6 packet |
| CVE-2021-31383 | 7.5 HIGH | Junos OS and Junos OS Evolved: In Point to MultiPoint (P2MP) scenarios receipt of various |
| CVE-2021-31375 | 7.2 HIGH | Junos OS: Receipt of a specific BGP update may cause RPKI policy-checks to be bypassed |
| CVE-2021-31384 | 7.2 HIGH | Junos OS: SRX Series: Under a specific device configuration an attacker can access the dev |
Showing top 20 of 42 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Juniper Networks
- CVE-2026-33791
Junos OS and Junos OS Evolved: Execution of crafted CLI comm - CVE-2026-33790
Junos OS: SRX Series: In a NAT64 configuration, receipt of a - CVE-2026-33787
Junos OS: SRX1500, SRX4100, SRX4200, SRX4600: When a specifi - CVE-2026-33785
Junos OS: MX Series: Missing Authorization for specific 'req - CVE-2026-33784
JSI Virtual Lightweight Collector: Default password is not r
Same weakness: CWE-319
- CVE-2026-45180
Catalyst::Plugin::Statsd versions through 0.10.0 for Perl ma - CVE-2026-45179
Plack::Middleware::Statsd versions before 0.9.0 for Perl may - CVE-2025-59852
HCL DFXAnalytics is affected by an Insufficient Transport - CVE-2026-7610
TRENDnet TEW-821DAP Firmware Update ssi cleartext transmissi - CVE-2026-42514
Sensitive Data Exposure Vulnerability in e-Sushrut HMIS
V. Comments for CVE-2021-0296
No comments yet