CVE-2024-30381
Assigner: juniper
Published: 2024-04-12T14:56:38.299Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Paragon Active Assurance
vendor: Juniper Networks
versions: status: affected
version: 4.1.0
status: affected
version: 4.2.0
datePublic: 2024-04-10T16:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: <p>An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Juniper Networks Paragon Active Assurance Control Center allows a network-adjacent attacker with root access to a Test Agent Appliance the ability to access sensitive information about downstream devices.<br><br>The "netrounds-probe-login" daemon (also called probe_serviced) exposes functions where the Test Agent (TA) Appliance pushes interface state/config, unregister itself, etc.  The remote service accidentally exposes an internal database object that can be used for direct database access on the Paragon Active Assurance Control Center.</p><p><br></p><p>This issue affects Paragon Active Assurance: 4.1.0, 4.2.0.<br></p>
value: An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Juniper Networks Paragon Active Assurance Control Center allows a network-adjacent attacker with root access to a Test Agent Appliance the ability to access sensitive information about downstream devices.

The "netrounds-probe-login" daemon (also called probe_serviced) exposes functions where the Test Agent (TA) Appliance pushes interface state/config, unregister itself, etc.  The remote service accidentally exposes an internal database object that can be used for direct database access on the Paragon Active Assurance Control Center.




This issue affects Paragon Active Assurance: 4.1.0, 4.2.0.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
cvssV4_0: Automatable: NOT_DEFINED
Recovery: NOT_DEFINED
Safety: NOT_DEFINED
attackComplexity: LOW
attackRequirements: NONE
attackVector: ADJACENT
baseScore: 8.4
baseSeverity: HIGH
privilegesRequired: HIGH
providerUrgency: NOT_DEFINED
subAvailabilityImpact: HIGH
subConfidentialityImpact: HIGH
subIntegrityImpact: HIGH
userInteraction: NONE
valueDensity: NOT_DEFINED
vectorString: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
version: 4.0
vulnAvailabilityImpact: NONE
vulnConfidentialityImpact: HIGH
vulnIntegrityImpact: NONE
vulnerabilityResponseEffort: NOT_DEFINED
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: The following software releases have been updated to resolve this specific issue: Paragon Active Assurance 4.2.1, 4.3.0, and all subsequent versions.<br>
value: The following software releases have been updated to resolve this specific issue: Paragon Active Assurance 4.2.1, 4.3.0, and all subsequent versions.
source: advisory: JSA79173
defect: PAALS-1573
discovery: USER
title: Paragon Active Assurance: probe_serviced exposes internal objects to local users
workarounds: supportingMedia: base64: no
type: text/html
value: <p>Use access lists or firewall filters to limit access to the Control Center only from trusted Test Agents and administrators.</p>
value: Use access lists or firewall filters to limit access to the Control Center only from trusted Test Agents and administrators.
x_generator: engine: Vulnogram 0.1.0-dev