CTPView: HSTS not being enforced on CTPView server.
Priority LOW 33CWE-319Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-319.
Summary
The Juniper Networks CTPView server is not enforcing HTTP Strict Transport Security (HSTS). HSTS is an optional response header which allows servers to indicate that content from the requested domain will only be served over HTTPS. The lack of HSTS may leave the system vulnerable to downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections. This issue affects Juniper Networks CTPView: 7.3 versions prior to 7.3R7; 9.1 versions prior to 9.1R3.
Why it matters now
EPSS 0.00504 43rd percentileScored 2026-11-07
Fix Fixed CTPView (Juniper Networks): 7.3R7, 9.1R3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Juniper | CTPView | 7.3 to before 7.3R7; 9.1 to before 9.1R3 | 7.3R7, 9.1R3 | Patch available | CNA |
- CTPView VendorJuniper Affected 7.3 to before 7.3R7; 9.1 to before 9.1R3 Fixed in 7.3R7, 9.1R3 Patch available CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:juniper:ctpview:7.3:r1:*:*:*:*:*:* | 7.3 r1 | Vulnerable | Juniper |
| cpe:2.3:a:juniper:ctpview:7.3:r2:*:*:*:*:*:* | 7.3 r2 | Vulnerable | Juniper |
| cpe:2.3:a:juniper:ctpview:7.3:r3:*:*:*:*:*:* | 7.3 r3 | Vulnerable | Juniper |
| cpe:2.3:a:juniper:ctpview:7.3:r4:*:*:*:*:*:* | 7.3 r4 | Vulnerable | Juniper |
| cpe:2.3:a:juniper:ctpview:7.3:r5:*:*:*:*:*:* | 7.3 r5 | Vulnerable | Juniper |
| cpe:2.3:a:juniper:ctpview:7.3:r6:*:*:*:*:*:* | 7.3 r6 | Vulnerable | Juniper |
| cpe:2.3:a:juniper:ctpview:9.1:r1:*:*:*:*:*:* | 9.1 r1 | Vulnerable | Juniper |
| cpe:2.3:a:juniper:ctpview:9.1:r2:*:*:*:*:*:* | 9.1 r2 | Vulnerable | Juniper |
- cpe:2.3:a:juniper:ctpview:7.3:r1:*:*:*:*:*:* Versions 7.3 r1 Vulnerable ·Juniper
- cpe:2.3:a:juniper:ctpview:7.3:r2:*:*:*:*:*:* Versions 7.3 r2 Vulnerable ·Juniper
- cpe:2.3:a:juniper:ctpview:7.3:r3:*:*:*:*:*:* Versions 7.3 r3 Vulnerable ·Juniper
- cpe:2.3:a:juniper:ctpview:7.3:r4:*:*:*:*:*:* Versions 7.3 r4 Vulnerable ·Juniper
- cpe:2.3:a:juniper:ctpview:7.3:r5:*:*:*:*:*:* Versions 7.3 r5 Vulnerable ·Juniper
- cpe:2.3:a:juniper:ctpview:7.3:r6:*:*:*:*:*:* Versions 7.3 r6 Vulnerable ·Juniper
- cpe:2.3:a:juniper:ctpview:9.1:r1:*:*:*:*:*:* Versions 9.1 r1 Vulnerable ·Juniper
- cpe:2.3:a:juniper:ctpview:9.1:r2:*:*:*:*:*:* Versions 9.1 r2 Vulnerable ·Juniper
Remediation
- Fix · CNA CTPView (Juniper Networks) Fixed in 7.3R7, 9.1R3
Timeline
- 2026-10-02 Threatist record created from CVE-2021-0296
- 2026-10-03 Alias added: GHSA-546v-59ph-f93v
References
Advisory 1
More Juniper Ctpview vulnerabilities
- TI-2009-01125 udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space… CVSS 2.0HIGH 7.2
- TI-2009-00107 The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath)… CVSS 3.1HIGH 7.8
Sources
- CVE-2021-0296 · CVE Program
- CVE-2021-0296 · NVD
- FIRST EPSS
- GHSA-546v-59ph-f93v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences