Vulnerability in Juniper Paragon Active Assurance Control Center
CVE-2024-21589
An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated network-based attacker to access reports without authenticating, potentially containing sensitive configuration information. A feature was introduced in version 3.1.0 of the Paragon Active Assurance Control Center which allows users to selectively share account data. By exploiting this vulnerability, it is possible to access reports without being logged in, resulting in the opportunity for malicious exfiltration of user data. Note that the Paragon Active Assurance Control Center SaaS offering is not affected by this issue. This issue affects Juniper Networks Paragon Active Assurance versions 3.1.0, 3.2.0, 3.2.2, 3.3.0, 3.3.1, 3.4.0. This issue does not affect Juniper Networks Paragon Active Assurance versions earlier than 3.1.0.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (35.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 35th percentile — 35.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Juniper Paragon Active Assurance Control Center — versions 3.1.0, 3.2.0, 3.2.2
- Juniper Networks Paragon Active Assurance — versions 0, 3.2.0, 3.2.2
Weakness classification (CWE)
References
- supportportal.juniper.net/JSA75727 (vendor-advisory, Vendor Advisory)
- www.first.org/cvss/calculator/4.0 (technical-description, Third Party Advisory)
Frequently asked questions
- What is CVE-2024-21589?
- CVE-2024-21589 is a high-severity vulnerability in Juniper Paragon Active Assurance Control Center, classified under Improper Access Control. CVSS score: 7.4/10. Published 2024-01-12.
- How severe is CVE-2024-21589?
- High severity. CVSS v3 base score is 7.4 out of 10.