CVE-2022-22190highCWE-284

CVE-2022-22190: fallo de gravedad alta en Juniper Networks Paragon Active Assurance

Paragon Active Assurance Control Center: Information disclosure vulnerability in crafted URL

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Paragon Active Assurance

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.4epss 1.0%
An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverage a crafted URL to generate PDF reports, potentially containing sensitive configuration information. A feature was introduced in version 3.1 of the Paragon Active Assurance Control Center which allows users to selective share account data using a unique identifier. Knowing the proper format of the URL and the identifier of an existing object in an application it is possible to get access to that object without being logged in, even if the object is not shared, resulting in the opportunity for malicious exfiltration of user data. Note that the Paragon Active Assurance Control Center SaaS offering is not affected by this issue. This issue affects Juniper Networks Paragon Active Assurance version 3.1.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Productos afectados
Juniper Networks · Paragon Active Assurance
CVEs relacionadas — Juniper Networks Paragon Active Assurance

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-0232HIGHParagon Active Assurance: Authentication bypass vulnerability in Control CenterEPSS 1.0%CVE-2024-30381HIGHParagon Active Assurance: probe_serviced exposes internal objects to local usersEPSS 0.5%CVE-2024-21589HIGHParagon Active Assurance Control Center: Information disclosure vulnerabilityEPSS 0.4%CVE-2023-28971HIGHParagon Active Assurance: Enabling the timescaledb enables IP forwardingEPSS 0.4%