← Back

CVE-2021-31349

nvd nist
Published: Oct 19, 2021Modified: Nov 21, 2024

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

The usage of an internal HTTP header created an authentication bypass vulnerability (CWE-287), allowing an attacker to view internal files, change settings, manipulate services and execute arbitrary code. This issue affects all Juniper Networks 128 Technology Session Smart Router versions prior to 4.5.11, and all versions of 5.0 up to and including 5.0.1.

Affected (2)

Juniper
1 product
128 Technology Session Smart Router Firmware
Configuration A
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Juniper
128 Technology Session Smart Router Firmware
Before 4.5.11
128 Technology Session Smart Router Firmware
From 5.0.0 to 5.0.1
Running on/withPlatform Versions
Juniper
128 Technology Session Smart Router
All versions

Related CWEs

CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

Source: sirt@juniper.net
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.