CVE-2019-0021CWE-532

Juniper ATP: secret CLI inputs are logged to /var/log/syslog in clear text

High · published January 15, 2019

CVSS v3.0
7.1
EPSS
0%
Percentile
25.7
In the wild
Unconfirmed
What it is

On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to view these secret information. This issue affects Juniper ATP 5.0 versions prior to 5.0.4.

The record
Technical detail
CVSS v3.0
7.1 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00336 · 25.7th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2019-01-15T21:00Z
EPSS history
Timeline
  • 15 JAN 21:00Z
    Juniper ATP: secret CLI inputs are logged to /var/log/syslog in clear text
    cvelistv5