Juniper ATP: secret CLI inputs are logged to /var/log/syslog in clear text
CVE-2019-0021

7.1HIGH

Key Information:

Vendor
Juniper Networks
Status
Juniper Atp
Vendor
CVE Published:
15 January 2019

Summary

On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to view these secret information. This issue affects Juniper ATP 5.0 versions prior to 5.0.4.

Affected Version(s)

Juniper ATP 5.0 < 5.0.4

References

https://kb.juniper.net/JSA10918
x_refsource_CONFIRM

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.