CVE-2019-0004CWE-532

Juniper ATP: API and device keys are logged in a world-readable permissions file

High · published January 15, 2019

CVSS v3.0
7.8
EPSS
0%
Percentile
24.9
In the wild
Unconfirmed
What it is

On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operations on the WebUI interface. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00330 · 24.9th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2019-01-15T21:00Z
EPSS history
Timeline
  • 15 JAN 21:00Z
    Juniper ATP: API and device keys are logged in a world-readable permissions file
    cvelistv5