Product:
Paragon Automation
Summary
A clickjacking vulnerability exists in the web portal of Juniper Networks Paragon Automation due to the application’s failure to set appropriate X-Frame-Options and X-Content-Type HTTP headers. This vulnerability allows an attacker to trick users into interacting with the interface under the attacker’s control. The issue affects all versions of Paragon Automation before 24.1.1.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.1 | CVE-2025-52987 |
Exploitation
To exploit this vulnerability, an attacker can create a malicious web page that embeds the vulnerable web portal within an iframe. By tricking users into visiting this page, the attacker can manipulate the users’ interactions with the web portal, potentially leading to unauthorized actions being taken on behalf of the user.
Affected Products
- Paragon Automation (Pathfinder, Planner, Insights) – All versions before 24.1.1 are affected by the clickjacking vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended to update to Paragon Automation version 24.1.1 or later, which includes the necessary security headers to prevent clickjacking attacks. Additionally, implementing proper security measures such as Content Security Policy (CSP) can help protect against similar vulnerabilities.