CVE-2019-0072 - Vulnerability Details - OpenCVE

An Unprotected Storage of Credentials vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information. This issue affects: Juniper Networks SBR Carrier: 8.4.1 versions prior to 8.4.1R13; 8.5.0 versions prior to 8.5.0R4.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Juniper	Sbr Carrier

Configuration 1 [-]

OR	cpe:2.3:a:juniper:sbr_carrier:8.4.1:-::::::
	cpe:2.3:a:juniper:sbr_carrier:8.4.1:r1::::::
	cpe:2.3:a:juniper:sbr_carrier:8.5.0:-::::::
	cpe:2.3:a:juniper:sbr_carrier:8.5.0:r1::::::

No data.

References

Link	Providers
https://kb.juniper.net/JSA10971

History

No history.

MITRE

Status: PUBLISHED

Assigner: juniper

Published: 2019-10-09T19:26:18.073970Z

Updated: 2024-09-16T18:56:06.030Z

Reserved: 2018-10-11T00:00:00

Link: CVE-2019-0072

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-10-09T20:15:18.190

Modified: 2024-11-21T04:16:11.597

Link: CVE-2019-0072

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "SBR Carrier", "vendor": "Juniper Networks", "versions": [{"lessThan": "8.4.1R13", "status": "affected", "version": "8.4.1", "versionType": "custom"}, {"lessThan": "8.5.0R4", "status": "affected", "version": "8.5.0", "versionType": "custom"}]}], "datePublic": "2019-10-09T00:00:00", "descriptions": [{"lang": "en", "value": "An Unprotected Storage of Credentials vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information. This issue affects: Juniper Networks SBR Carrier: 8.4.1 versions prior to 8.4.1R13; 8.5.0 versions prior to 8.5.0R4."}], "exploits": [{"lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-256", "description": "CWE-256 Unprotected Storage of Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-10-09T19:26:18", "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "shortName": "juniper"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://kb.juniper.net/JSA10971"}], "solutions": [{"lang": "en", "value": "The following software releases have been updated to resolve this specific issue: \n8.4.1R13, 8.5.0R4 and all subsequent releases."}], "source": {"advisory": "JSA10971", "defect": ["1358911"], "discovery": "INTERNAL"}, "title": "SBR Carrier: A vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information.", "workarounds": [{"lang": "en", "value": "There are no viable workarounds for this issue."}], "x_generator": {"engine": "Vulnogram 0.0.6"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "sirt@juniper.net", "DATE_PUBLIC": "2019-10-09T16:00:00.000Z", "ID": "CVE-2019-0072", "STATE": "PUBLIC", "TITLE": "SBR Carrier: A vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information."}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SBR Carrier", "version": {"version_data": [{"version_affected": "<", "version_name": "8.4.1", "version_value": "8.4.1R13"}, {"version_affected": "<", "version_name": "8.5.0", "version_value": "8.5.0R4"}]}}]}, "vendor_name": "Juniper Networks"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An Unprotected Storage of Credentials vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information. This issue affects: Juniper Networks SBR Carrier: 8.4.1 versions prior to 8.4.1R13; 8.5.0 versions prior to 8.5.0R4."}]}, "exploit": [{"lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "generator": {"engine": "Vulnogram 0.0.6"}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-256 Unprotected Storage of Credentials"}]}]}, "references": {"reference_data": [{"name": "https://kb.juniper.net/JSA10971", "refsource": "MISC", "url": "https://kb.juniper.net/JSA10971"}]}, "solution": [{"lang": "en", "value": "The following software releases have been updated to resolve this specific issue: \n8.4.1R13, 8.5.0R4 and all subsequent releases."}], "source": {"advisory": "JSA10971", "defect": ["1358911"], "discovery": "INTERNAL"}, "work_around": [{"lang": "en", "value": "There are no viable workarounds for this issue."}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T17:37:07.541Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://kb.juniper.net/JSA10971"}]}]}, "cveMetadata": {"assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "assignerShortName": "juniper", "cveId": "CVE-2019-0072", "datePublished": "2019-10-09T19:26:18.073970Z", "dateReserved": "2018-10-11T00:00:00", "dateUpdated": "2024-09-16T18:56:06.030Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:juniper:sbr_carrier:8.4.1:-:*:*:*:*:*:*", "matchCriteriaId": "78A26AE0-EE51-4025-A2CD-20ADEAB30984", "vulnerable": true}, {"criteria": "cpe:2.3:a:juniper:sbr_carrier:8.4.1:r1:*:*:*:*:*:*", "matchCriteriaId": "0EC0CA17-7192-4148-AFBE-D5131739ABF2", "vulnerable": true}, {"criteria": "cpe:2.3:a:juniper:sbr_carrier:8.5.0:-:*:*:*:*:*:*", "matchCriteriaId": "5074BF1F-5200-47EE-B3EE-E17B0ACE1B41", "vulnerable": true}, {"criteria": "cpe:2.3:a:juniper:sbr_carrier:8.5.0:r1:*:*:*:*:*:*", "matchCriteriaId": "EB662679-973C-4D4E-BF7C-C62E338BFEBD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An Unprotected Storage of Credentials vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information. This issue affects: Juniper Networks SBR Carrier: 8.4.1 versions prior to 8.4.1R13; 8.5.0 versions prior to 8.5.0R4."}, {"lang": "es", "value": "Una vulnerabilidad de Almacenamiento No Protegido de Credenciales en el procedimiento de generaci\u00f3n de certificados de administraci\u00f3n de identidad y acceso, permite a un atacante local conseguir acceso a informaci\u00f3n confidencial. Este problema afecta a: Juniper Networks SBR Carrier: versiones 8.4.1 anteriores a 8.4.1R13; versiones 8.5.0 anteriores a 8.5.0R4."}], "id": "CVE-2019-0072", "lastModified": "2024-11-21T04:16:11.597", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.1, "impactScore": 4.0, "source": "sirt@juniper.net", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-10-09T20:15:18.190", "references": [{"source": "sirt@juniper.net", "tags": ["Vendor Advisory"], "url": "https://kb.juniper.net/JSA10971"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://kb.juniper.net/JSA10971"}], "sourceIdentifier": "sirt@juniper.net", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-256"}], "source": "sirt@juniper.net", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}]}