PT-2022-5303 · Juniper Networks · Juniper Networks Paragon Active Assurance

Published 2022-10-12 · Updated 2022-10-20 · CVE-2022-22229

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Juniper Networks Paragon Active Assurance (Formerly Netrounds) versions prior to 3.1.1 Juniper Networks Paragon Active Assurance (Formerly Netrounds) version 3.2 prior to 3.2.1

Description The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as a Cross-site Scripting (XSS) vulnerability, specifically a stored or persistent XSS. This vulnerability in the Control Center Controller web pages of Juniper Networks Paragon Active Assurance allows a high-privilege attacker with 'WRITE' permissions to store malicious scripts. These scripts can infect any other authorized user's account when they trigger the malicious script while managing the device, enabling the attacker to execute commands with permissions up to that of the superuser account.

Recommendations For versions prior to 3.1.1, update to version 3.1.1 or later. For version 3.2 prior to 3.2.1, update to version 3.2.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-06593

CVE-2022-22229

Affected Products

Juniper Networks Paragon Active Assurance

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-22229 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22229 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06593 · Security Note
• https://kb.juniper.net/JSA69883 · Vendor Advisory