CVE-2022-22190highCWE-284

CVE-2022-22190: high-severity vulnerability in Juniper Networks Paragon Active Assurance

Paragon Active Assurance Control Center: Information disclosure vulnerability in crafted URL

Published · Updated

Follow this CVE+ Monitor Paragon Active Assurance

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.4epss 1.0%
An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverage a crafted URL to generate PDF reports, potentially containing sensitive configuration information. A feature was introduced in version 3.1 of the Paragon Active Assurance Control Center which allows users to selective share account data using a unique identifier. Knowing the proper format of the URL and the identifier of an existing object in an application it is possible to get access to that object without being logged in, even if the object is not shared, resulting in the opportunity for malicious exfiltration of user data. Note that the Paragon Active Assurance Control Center SaaS offering is not affected by this issue. This issue affects Juniper Networks Paragon Active Assurance version 3.1.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Affected products
Juniper Networks · Paragon Active Assurance
Related CVEs — Juniper Networks Paragon Active Assurance

In the same product, most dangerous first.

CVE-2021-0232HIGHParagon Active Assurance: Authentication bypass vulnerability in Control CenterEPSS 1.0%CVE-2024-30381HIGHParagon Active Assurance: probe_serviced exposes internal objects to local usersEPSS 0.5%CVE-2024-21589HIGHParagon Active Assurance Control Center: Information disclosure vulnerabilityEPSS 0.4%CVE-2023-28971HIGHParagon Active Assurance: Enabling the timescaledb enables IP forwardingEPSS 0.4%