PT-2022-15288 · Juniper Networks · Juniper Networks Paragon Active Assurance

Published 2022-04-14 · Updated 2023-06-27 · CVE-2022-22190

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Juniper Networks Paragon Active Assurance version 3.1.0

Description An issue in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverage a crafted URL to generate PDF reports, potentially containing sensitive configuration information. A feature introduced in version 3.1 allows users to selectively share account data using a unique identifier. Knowing the proper format of the URL and the identifier of an existing object in an application, it is possible to get access to that object without being logged in, even if the object is not shared, resulting in the opportunity for malicious exfiltration of user data.

Recommendations As a temporary workaround, consider restricting access to the unique identifier feature until a patch is available. Update to a version that fixes this issue, if available. Note: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

CVE-2022-22190

Affected Products

Juniper Networks Paragon Active Assurance

References · 5

• https://osv.dev/vulnerability/CVE-2022-22190 · Vendor Advisory
• https://kb.juniper.net/JSA69500 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22190 · Security Note
• https://t.me/cvenotify/28933 · Telegram Post
• https://t.me/cibsecurity/40793 · Telegram Post