CVE-2019-0032

Description

A password management issue exists where the Organization authentication username and password were stored in plaintext in log files. A locally authenticated attacker who is able to access these stored plaintext credentials can use them to login to the Organization. Affected products are: Juniper Networks Service Insight versions from 15.1R1, prior to 18.1R1. Service Now versions from 15.1R1, prior to 18.1R1.

Weakness classification

• CWE-256: Plaintext Storage of a Password
• CWE-522: Insufficiently Protected Credentials
• CWE-532: Insertion of Sensitive Information into Log File

Primary references

• sirt@juniper.net — Third Party Advisory, VDB Entry
• sirt@juniper.net — Vendor Advisory
• sirt@juniper.net — Release Notes, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory