« Volver al listado

CVE-2022-22229

Estado: ModificadaAlta (8.4)—

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability, a stored XSS (or persistent), in the Control Center Controller web pages of Juniper Networks Paragon Active Assurance (Formerly Netrounds) allows a high-privilege attacker with 'WRITE' permissions to store one or more malicious scripts that will infect any other authorized user's account when they accidentally trigger the malicious script(s) while managing the device. Triggering these attacks enables the attacker to execute commands with the permissions up to that of the superuser account. This issue affects: Juniper Networks Paragon Active Assurance (Formerly Netrounds) All versions prior to 3.1.1; 3.2 versions prior to 3.2.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Juniper — Paragon Active Assurance Control Center

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-22229",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-22229",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-12T14:28:36.913015Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "sirt@juniper.net",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.4,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "sirt@juniper.net",
      "affectedData": [
        {
          "vendor": "Juniper Networks",
          "product": "Paragon Active Assurance (Formerly Netrounds)",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "3.1.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "3.2",
              "lessThan": "3.2.1",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-10-18T03:15:10.130",
  "references": [
    {
      "url": "https://kb.juniper.net/JSA69883",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "sirt@juniper.net"
    },
    {
      "url": "https://kb.juniper.net/JSA69883",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "sirt@juniper.net",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability, a stored XSS (or persistent), in the Control Center Controller web pages of Juniper Networks Paragon Active Assurance (Formerly Netrounds) allows a high-privilege attacker with 'WRITE' permissions to store one or more malicious scripts that will infect any other authorized user's account when they accidentally trigger the malicious script(s) while managing the device. Triggering these attacks enables the attacker to execute commands with the permissions up to that of the superuser account. This issue affects: Juniper Networks Paragon Active Assurance (Formerly Netrounds) All versions prior to 3.1.1; 3.2 versions prior to 3.2.1."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Neutralización Inapropiada de la Entrada Durante la Generación de la Página Web (\"Cross-site Scripting\"), un ataque de tipo XSS almacenado (o persistente), en las páginas web del Control Center Controller de Juniper Networks Paragon Active Assurance (anteriormente Netrounds) permite a un atacante de alto privilegio con permisos \"WRITE\" almacenar uno o más scripts maliciosos que infectarán la cuenta de cualquier otro usuario autorizado cuando accidentalmente desencadene el o los scripts maliciosos mientras administra el dispositivo. El desencadenamiento de estos ataques permite al atacante ejecutar comandos con los permisos hasta los de la cuenta de super usuario. Este problema afecta a: Juniper Networks Paragon Active Assurance (anteriormente Netrounds) Todas las versiones anteriores a 3.1.1; versiones 3.2 anteriores a 3.2.1"
    }
  ],
  "lastModified": "2026-06-17T04:28:03.653",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:juniper:paragon_active_assurance_control_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF20EF2F-C73D-40F1-A14A-B2ECDBA5F31B",
              "versionEndExcluding": "3.1.1"
            },
            {
              "criteria": "cpe:2.3:a:juniper:paragon_active_assurance_control_center:3.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "352638F4-0F30-4A1F-9D53-E9E2158FA826"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "sirt@juniper.net"
}