An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverage a crafted URL to generate PDF reports, potentially containing sensitive configuration information. A feature was introduced in version 3.1 of the Paragon Active Assurance Control Center which allows users to selective share account data using a unique identifier. Knowing the proper format of the URL and the identifier of an existing object in an application it is possible to get access to that object without being logged in, even if the object is not shared, resulting in the opportunity for malicious exfiltration of user data. Note that the Paragon Active Assurance Control Center SaaS offering is not affected by this issue. This issue affects Juniper Networks Paragon Active Assurance version 3.1.0.
Published 2022-04-14 16:15:08
Updated 2023-06-27 19:01:00
View at NVD,   CVE.org
Vulnerability category: BypassGain privilege

Exploit prediction scoring system (EPSS) score for CVE-2022-22190

0.15%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 51 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-22190

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
4.3
MEDIUM AV:N/AC:M/Au:N/C:P/I:N/A:N
8.6
2.9
NIST
7.5
HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
3.9
3.6
NIST
7.4
HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
2.8
4.0
Juniper Networks, Inc.

CWE ids for CVE-2022-22190

  • The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
    Assigned by: sirt@juniper.net (Secondary)
  • The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
    Assigned by: nvd@nist.gov (Primary)
  • The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-22190

  • https://kb.juniper.net/JSA69500
    2022-04 Security Bulletin: Paragon Active Assurance Control Center: Information disclosure vulnerability in crafted URL (CVE-2022-22190)
    Vendor Advisory

Products affected by CVE-2022-22190

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!