CVE-2019-0021

Summary

On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to view these secret information. This issue affects Juniper ATP 5.0 versions prior to 5.0.4.

Affected Software

VendorProductVersion RangeStatus
Juniper NetworksJuniper ATP5.0 < 5.0.4affected

Weaknesses

  • CWE-532: CWE-532 - Information Exposure Through Log Files

Workarounds

There are no known workarounds for this issue, however limit the access to only trusted administrators from trusted administrative networks or hosts would minimize the risk.

ADP Enrichment

CVE Program Container

Additional References

References