CVE-2019-0021

CWE-532 — Log File Information Exposure5 documents5 sources

Severity

5.5MEDIUM

EPSS

0.1%

top 83.32%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Juniper Networks Juniper ATP Juniper Advanced Threat Prevention

Timeline

PublishedJan 15

Latest updateMay 13

Description

On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to view these secret information. This issue affects Juniper ATP 5.0 versions prior to 5.0.4.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 1.8 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5juniper_networks/juniper_atp5.0 — 5.0.4

▶NVDjuniper/advanced_threat_prevention5.0.0 — 5.0.4

🔴Vulnerability Details

GHSA

GHSA-6cqx-g9mw-4p5m: On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be↗2022-05-13

▶

CVEList

Juniper ATP: secret CLI inputs are logged to /var/log/syslog in clear text↗2019-01-15

▶

📋Vendor Advisories

VMware

VMware Workstation and Fusion updates address multiple security vulnerabilities (CVE-2019-5540, CVE-2019-5541, CVE-2019-5542)↗2019-11-12

▶

Juniper

CVE-2019-0021: On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be↗2019-01-15

▶