CVE Feed

    Dashboard / CVE / CVE-2019-0020

    CVE-2019-0020

    Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3.

    Published:Jan 15, 2019
    Last Modified:Nov 21, 2024
    EPS:Jan 15, 2019
    EPSS Score:0.00408
    CVSS Score:10

    Affected Products

    Vendor
    Juniper
    Product
    Advanced Threat Prevention
    Vendor
    Juniper
    Product
    Atp400
    Vendor
    Juniper
    Product
    Atp700

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-798 Use of Hard-coded Credentials

    Related CVEs

    CVE-2019-0021 (CVSS 7.1) — On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, …
    CVE-2019-0024 (CVSS 5.4) — A persistent cross-site scripting (XSS) vulnerability in the Email Collectors menu of Juniper ATP may allow au…
    CVE-2019-0025 (CVSS 5.4) — A persistent cross-site scripting (XSS) vulnerability in RADIUS configuration menu of Juniper ATP may allow au…
    CVE-2019-0026 (CVSS 5.4) — A persistent cross-site scripting (XSS) vulnerability in the Zone configuration of Juniper ATP may allow authe…
    CVE-2019-0027 (CVSS 5.4) — A persistent cross-site scripting (XSS) vulnerability in the Snort Rules configuration of Juniper ATP may allo…
    CVE-2019-0029 (CVSS 8.8) — Juniper ATP Series Splunk credentials are logged in a file readable by authenticated local users. Using these …
    CVE-2019-0004 (CVSS 5.5) — On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. The…
    CVE-2019-0018 (CVSS 5.4) — A persistent cross-site scripting (XSS) vulnerability in the file upload menu of Juniper ATP may allow an auth…
    CVE-2019-0022 (CVSS 10) — Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability…
    CVE-2019-0023 (CVSS 5.4) — A persistent cross-site scripting (XSS) vulnerability in the Golden VM menu of Juniper ATP may allow authentic…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High