CVE-2022-22229: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability, a stored XSS (or persistent), in the Control Center…

PriorityP338high8.4CVSS 3.1

AVNACLPRHUIRSCCHIHAH

EPSS

0.67%

48.0th percentile

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability, a stored XSS (or persistent), in the Control Center Controller web pages of Juniper Networks Paragon Active Assurance (Formerly Netrounds) allows a high-privilege attacker with 'WRITE' permissions to store one or more malicious scripts that will infect any other authorized user's account when they accidentally trigger the malicious script(s) while managing the device. Triggering these attacks enables the attacker to execute commands with the permissions up to that of the superuser account. This issue affects: Juniper Networks Paragon Active Assurance (Formerly Netrounds) All versions prior to 3.1.1; 3.2 versions prior to 3.2.1.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
juniper	paragon_active_assurance_control_center	< 3.1.1	3.1.1
juniper	paragon_active_assurance_control_center	—	—
juniper_networks	paragon_active_assurance	>= 3.2 < 3.2.1	3.2.1
juniper_networks	paragon_active_assurance	>= unspecified < 3.1.1	3.1.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.