CVE-2022-22190 — Improper Access Control in Networks Paragon Active Assurance

CWE-284 — Improper Access ControlCWE-639 — Authorization Bypass Through User-Controlled KeyCWE-863 — Incorrect Authorization4 documents4 sources
Severity
7.5HIGHNVD
CNA7.4
EPSS
1.0%
top 23.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Juniper Networks Paragon Active AssuranceJuniper Paragon Active Assurance Control Center
Timeline
PublishedApr 14
Latest updateApr 15

Description

An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverage a crafted URL to generate PDF reports, potentially containing sensitive configuration information. A feature was introduced in version 3.1 of the Paragon Active Assurance Control Center which allows users to selective share account data using a unique identifier. Knowing the proper format of the URL and the identifier of an existing object in an …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-h42q-jjcq-2ff4: An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverag↗2022-04-15
▶
CVEList
Paragon Active Assurance Control Center: Information disclosure vulnerability in crafted URL↗2022-04-14
▶

📋Vendor Advisories

1
Juniper
CVE-2022-22190: An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverag↗2022-04-14
▶
CVE-2022-22190 — Improper Access Control | cvebase