CVE-2021-0296

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

The Juniper Networks CTPView server is not enforcing HTTP Strict Transport Security (HSTS). HSTS is an optional response header which allows servers to indicate that content from the requested domain will only be served over HTTPS. The lack of HSTS may leave the system vulnerable to downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections. This issue affects Juniper Networks CTPView: 7.3 versions prior to 7.3R7; 9.1 versions prior to 9.1R3.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
Juniper Networks	CTPView	>= 7.3, < 7.3R7; >= 9.1, < 9.1R3

References

https://kb.juniper.net/JSA11210Vendor Advisory
https://kb.juniper.net/JSA11210Vendor Advisory

Timeline

Published: Oct 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-02976.5A vulnerability in the processing of TCP MD5 authentication in Juniper Networks Junos OS Evolved may allow a BGP or LDP session configured w CVE-2021-02984.7A Race Condition in the 'show chassis pic' command in Juniper Networks Junos OS Evolved may allow an attacker to crash the port interface co CVE-2021-02997.5An Improper Handling of Exceptional Conditions vulnerability in the processing of a transit or directly received malformed IPv6 packet in Ju CVE-2021-03016.7In ged, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System CVE-2021-03027.8In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privileg CVE-2021-03037.0In dispatchGraphTerminationMessage() of packages/services/Car/computepipe/runner/graph/StreamSetObserver.cpp, there is a possible use after CVE-2021-03045.5In several functions of GlobalScreenshot.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to loca CVE-2021-03057.8In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privileg CVE-2021-03067.8In addAllPermissions of PermissionManagerService.java, there is a possible permissions bypass when upgrading major Android versions which al CVE-2021-03077.8In updatePermissionSourcePackage of PermissionManagerService.java, there is a possible automatic runtime permission grant due to a confused CVE-2021-03086.8In ReadLogicalParts of basicmbr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalati CVE-2021-03095.5In onCreate of grantCredentialsPermissionActivity, there is a confused deputy. This could lead to local information disclosure and account a