CVE-2019-0022

CWE-798 — Hard-coded Credentials6 documents6 sources
Severity
9.8CRITICAL
EPSS
0.4%
top 38.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Juniper Networks Juniper ATPJuniper Advanced Threat Prevention
Timeline
PublishedJan 15
Latest updateMay 13

Description

Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 3.9 | Impact: 6.0

Affected Packages2 packages

▶CVEListV5juniper_networks/juniper_atp5.0 — 5.0.3

🔴Vulnerability Details

2
GHSA
GHSA-4c33-jjxv-7pfw: Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full control of any installatio↗2022-05-13
▶
CVEList
Juniper ATP: Two hard coded credentials sharing the same password give an attacker the ability to take control of any installation of the software.↗2019-01-15
▶

📋Vendor Advisories

2
VMware
VMware ESXi and Horizon DaaS updates address OpenSLP remote code execution vulnerability (CVE-2019-5544)↗2019-12-05
▶
Juniper
CVE-2019-0022: Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full control of any installatio↗2019-01-15
▶

💬Community

1
Bugzilla
CVE-2019-5544 openslp: Heap-based buffer overflow in ProcessSrvRqst() in slpd_process.c leading to remote code execution↗2019-11-28
▶
CVE-2019-0022 (CRITICAL CVSS 9.8) | Juniper ATP ships with hard coded c | cvebase.io