Lucene search

JuniperCVELIST:CVE-2021-31349

HistoryOct 19, 2021 - 6:16 p.m.

CVE-2021-31349 Session Smart Router: Authentication Bypass Vulnerability

2021-10-1918:16:28

CWE-287

juniper

www.cve.org

session smart router

authentication bypass

cwe-287

juniper networks

internal files

change settings

arbitrary code

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.004

Percentile

73.9%

JSON

The usage of an internal HTTP header created an authentication bypass vulnerability (CWE-287), allowing an attacker to view internal files, change settings, manipulate services and execute arbitrary code. This issue affects all Juniper Networks 128 Technology Session Smart Router versions prior to 4.5.11, and all versions of 5.0 up to and including 5.0.1.

CNA Affected

[
  {
    "product": "128 Technology Session Smart Router",
    "vendor": "Juniper Networks",
    "versions": [
      {
        "lessThan": "4.5.11",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "5.0.1",
        "status": "affected",
        "version": "5.0",
        "versionType": "custom"
      }
    ]
  }
]

References

kb.juniper.net/JSA11256

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.004

Percentile

73.9%

JSON

Related for CVELIST:CVE-2021-31349