7.8high
CVE-2019-0004
Juniper ATP: API and device keys are logged in a world-readable permissions file
Published 7 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 26%
Public exploits
0
none known
Summary
On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operations on the WebUI interface. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
Exploit prediction (EPSS)
0.33% probability of exploitation in the next 30 days, higher than 26% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- Juniper Networks Juniper ATP
Classification
- Weakness
- CWE-532 Insertion of Sensitive Information into Log File
References
- kb.juniper.net /JSA10918 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2019-0004
- NVD: CVE-2019-0004
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.