CVE-2019-0004 Juniper ATP: API and device keys are logged in a world-readable permissions file
MediumCVSS 5.5
EPSS 0.33%
- Published
- Updated
- Exploit status
- No public exploit known
Description
On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operations on the WebUI interface. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| juniper advanced threat prevention | >= 5.0.0, < 5.0.3 | 5.0.3 |
| Juniper ATP | >= 5.0, < 5.0.3 | 5.0.3 |
References
- kb.juniper.net vendor-advisory