Paragon Active Assurance Control Center: Information disclosure vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated network-based attacker to access reports without authenticating, potentially containing sensitive configuration information. A feature was introduced in version 3.1.0 of the Paragon Active Assurance Control Center which allows users to selectively share account data. By exploiting this vulnerability, it is possible to access reports without being logged in, resulting in the opportunity for malicious exfiltration of user data. Note that the Paragon Active Assurance Control Center SaaS offering is not affected by this issue. This issue affects Juniper Networks Paragon Active Assurance versions 3.1.0, 3.2.0, 3.2.2, 3.3.0, 3.3.1, 3.4.0. This issue does not affect Juniper Networks Paragon Active Assurance versions earlier than 3.1.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Juniper | Paragon Active Assurance | 3.2.0 and later; 3.2.2 and later; 3.3.0 and later; 3.3.1 and later; 3.4.0 and later | — | Patch available | CNA |
- Paragon Active Assurance VendorJuniper Affected 3.2.0 and later; 3.2.2 and later; 3.3.0 and later; 3.3.1 and later; 3.4.0 and later Fixed in — Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:juniper:paragon_active_assurance_control_center:3.1.0:*:*:*:*:*:*:* | 3.1.0 | Vulnerable | Juniper |
| cpe:2.3:a:juniper:paragon_active_assurance_control_center:3.2.0:*:*:*:*:*:*:* | 3.2.0 | Vulnerable | Juniper |
| cpe:2.3:a:juniper:paragon_active_assurance_control_center:3.2.2:*:*:*:*:*:*:* | 3.2.2 | Vulnerable | Juniper |
| cpe:2.3:a:juniper:paragon_active_assurance_control_center:3.3.0:*:*:*:*:*:*:* | 3.3.0 | Vulnerable | Juniper |
| cpe:2.3:a:juniper:paragon_active_assurance_control_center:3.3.1:*:*:*:*:*:*:* | 3.3.1 | Vulnerable | Juniper |
| cpe:2.3:a:juniper:paragon_active_assurance_control_center:3.4.0:*:*:*:*:*:*:* | 3.4.0 | Vulnerable | Juniper |
- cpe:2.3:a:juniper:paragon_active_assurance_control_center:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Juniper
- cpe:2.3:a:juniper:paragon_active_assurance_control_center:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Juniper
- cpe:2.3:a:juniper:paragon_active_assurance_control_center:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·Juniper
- cpe:2.3:a:juniper:paragon_active_assurance_control_center:3.3.0:*:*:*:*:*:*:* Versions 3.3.0 Vulnerable ·Juniper
- cpe:2.3:a:juniper:paragon_active_assurance_control_center:3.3.1:*:*:*:*:*:*:* Versions 3.3.1 Vulnerable ·Juniper
- cpe:2.3:a:juniper:paragon_active_assurance_control_center:3.4.0:*:*:*:*:*:*:* Versions 3.4.0 Vulnerable ·Juniper
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-21589
- 2026-10-03 Alias added: GHSA-c9hp-xj9x-p4wm
References
More Juniper Paragon Active Assurance Control Center vulnerabilities
- TI-2022-06559 Paragon Active Assurance (Formerly Netrounds): Stored Cross-site Scripting (XSS) vulnerability in web administration CVSS 3.1HIGH 8.4
- TI-2024-20117 Paragon Active Assurance: probe_serviced exposes internal objects to local users CVSS 4.0HIGH 8.4
- TI-2022-06523 Paragon Active Assurance Control Center: Information disclosure vulnerability in crafted URL CVSS 3.1HIGH 7.5
- TI-2021-00166 Paragon Active Assurance: Authentication bypass vulnerability in Control Center CVSS 3.1HIGH 7.4
Sources
- CVE-2024-21589 · CVE Program
- CVE-2024-21589 · NVD
- FIRST EPSS
- GHSA-c9hp-xj9x-p4wm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences