5.8Media
CVE-2026-103405Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting
Descripción
An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the web server in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to inject arbitrary HTTP headers via unsanitized request body parameters.
Debilidad (CWE):
CWE-74
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Juniper Networks | Session Smart Conductor | < 7.0.5, 7.1.0 – < 7.1.7, 7.2.0 – < 7.2.3 | |
| Juniper Networks | Session Smart Router | < 7.0.5, 7.1.0 – < 7.1.7, 7.2.0 – < 7.2.3 |
Referencias y parches
- https://supportportal.juniper.net/JSA112183 vendor-advisory