// For flags

CVE-2022-22229

Paragon Active Assurance (Formerly Netrounds): Stored Cross-site Scripting (XSS) vulnerability in web administration

Severity Score

8.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability, a stored XSS (or persistent), in the Control Center Controller web pages of Juniper Networks Paragon Active Assurance (Formerly Netrounds) allows a high-privilege attacker with 'WRITE' permissions to store one or more malicious scripts that will infect any other authorized user's account when they accidentally trigger the malicious script(s) while managing the device. Triggering these attacks enables the attacker to execute commands with the permissions up to that of the superuser account. This issue affects: Juniper Networks Paragon Active Assurance (Formerly Netrounds) All versions prior to 3.1.1; 3.2 versions prior to 3.2.1.

Una vulnerabilidad de Neutralización Inapropiada de la Entrada Durante la Generación de la Página Web ("Cross-site Scripting"), un ataque de tipo XSS almacenado (o persistente), en las páginas web del Control Center Controller de Juniper Networks Paragon Active Assurance (anteriormente Netrounds) permite a un atacante de alto privilegio con permisos "WRITE" almacenar uno o más scripts maliciosos que infectarán la cuenta de cualquier otro usuario autorizado cuando accidentalmente desencadene el o los scripts maliciosos mientras administra el dispositivo. El desencadenamiento de estos ataques permite al atacante ejecutar comandos con los permisos hasta los de la cuenta de super usuario. Este problema afecta a: Juniper Networks Paragon Active Assurance (anteriormente Netrounds) Todas las versiones anteriores a 3.1.1; versiones 3.2 anteriores a 3.2.1

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Multiple
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-12-21 CVE Reserved
  • 2022-10-18 CVE Published
  • 2024-09-16 CVE Updated
  • 2024-12-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (1)
URL Tag Source
URL Date SRC
URL Date SRC
URL Date SRC
https://kb.juniper.net/JSA69883 2022-10-20
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Juniper
Search vendor "Juniper"
 Paragon Active Assurance Control Center
Search vendor "Juniper" for product "Paragon Active Assurance Control Center"
 < 3.1.1
Search vendor "Juniper" for product "Paragon Active Assurance Control Center" and version " < 3.1.1"
-
Affected
Juniper
Search vendor "Juniper"
 Paragon Active Assurance Control Center
Search vendor "Juniper" for product "Paragon Active Assurance Control Center"
 3.2.0
Search vendor "Juniper" for product "Paragon Active Assurance Control Center" and version "3.2.0"
-
Affected