Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Junos OS: J-Web has an Improper Neutralization of CRLF Sequences in its HTTP Headers which allows an attacker to carry out multiple types of attacks. (Juniper Networks Junos OS)

CVE-2021-0268
HIGH 8.8

At a glance

Source
NVD
EPSS
EPSS 0.85 % · percentile 58 ()
State
PUBLISHED
Published
Updated
Assigner
juniper
NVD status
Modified

Search on…

Description

An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') weakness in J-web of Juniper Networks Junos OS leads to buffer overflows, segment faults, or other impacts, which allows an attacker to modify the integrity of the device and exfiltration information from the device without authentication. The weakness can be exploited to facilitate cross-site scripting (XSS), cookie manipulation (modifying session cookies, stealing cookies) and more. This weakness can also be exploited by directing a user to a seemingly legitimate link from the affected site. The attacker requires no special access or permissions to the device to carry out such attacks. This issue affects: Juniper Networks Junos OS: 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S5; 18.3 versions prior to 18.3R2-S4, 18.3R3-S3; 18.4 versions prior to 18.4R2-S5, 18.4R3-S3; 19.1 versions prior to 19.1R2-S2, 19.1R3-S2; 19.2 versions prior to 19.2R1-S5, 19.2R2; 19.3 versions prior to 19.3R3; 19.4 versions prior to 19.4R1-S3, 19.4R2, 19.4R3; 20.1 versions prior to 20.1R1-S2, 20.1R2. This issue does not affect Juniper Networks Junos OS versions prior to 18.1R1.

Weaknesses (CWE)

  • CWE-113 — Improper Neutralization of CRLF Sequences in HTTP Headers
  • CWE-120 — Buffer Copy without Checking Size of Input
  • CWE-79 — Improper Neutralization of Input During Web Page Generation
  • CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:Ljuniper
CVSS 3.1HIGH 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:LNVD · sirt@juniper.net (Secondary)
CVSS 3.1CRITICAL 9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NNVD · nvd@nist.gov (Primary)
CVSS 2.0MEDIUM 5.8AV:N/AC:M/Au:N/C:P/I:P/A:NNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Juniper Networks · Junos OSunaffected unspecified < 18.1R1 ; affected 18.1 < 18.1R3-S11 ; affected 18.2 < 18.2R3-S5 ; affected 18.3 < 18.3R2-S4, 18.3R3-S3 ; affected 18.4 < 18.4R2-S5, 18.4R3-S3 ; affected 19.1 < 19.1R2-S2, 19.1R3-S2

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD