CVE-2019-0021

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to view these secret information. This issue affects Juniper ATP 5.0 versions prior to 5.0.4.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

Vendor	Product	Versions
Juniper Networks	Juniper ATP	>= 5.0, < 5.0.4

References

https://kb.juniper.net/JSA10918Vendor Advisory
https://kb.juniper.net/JSA10918Vendor Advisory

Timeline

Published: Jan 15, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-00229.8Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full control of any i CVE-2019-00235.4A persistent cross-site scripting (XSS) vulnerability in the Golden VM menu of Juniper ATP may allow authenticated user to inject arbitrary CVE-2019-00245.4A persistent cross-site scripting (XSS) vulnerability in the Email Collectors menu of Juniper ATP may allow authenticated user to inject arb CVE-2019-00255.4A persistent cross-site scripting (XSS) vulnerability in RADIUS configuration menu of Juniper ATP may allow authenticated user to inject arb CVE-2019-00265.4A persistent cross-site scripting (XSS) vulnerability in the Zone configuration of Juniper ATP may allow authenticated user to inject arbitr CVE-2019-00275.4A persistent cross-site scripting (XSS) vulnerability in the Snort Rules configuration of Juniper ATP may allow authenticated user to inject CVE-2019-00287.5On Junos devices with the BGP graceful restart helper mode enabled or the BGP graceful restart mechanism enabled, a BGP session restart on a CVE-2019-00297.8Juniper ATP Series Splunk credentials are logged in a file readable by authenticated local users. Using these credentials an attacker can ac CVE-2019-00307.2Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue af CVE-2019-00317.5Specific IPv6 DHCP packets received by the jdhcpd daemon will cause a memory resource consumption issue to occur on a Junos OS device using CVE-2019-00327.8A password management issue exists where the Organization authentication username and password were stored in plaintext in log files. A loca CVE-2019-00337.5A firewall bypass vulnerability in the proxy ARP service of Juniper Networks Junos OS allows an attacker to cause a high CPU condition leadi