Search
Find a vulnerability
Search criteria
8 vulnerabilities found for metasys_system_configuration_tool by johnsoncontrols
CVE-2022-21940 (GCVE-0-2022-21940)
Vulnerability from nvd – Published: 2023-02-09 20:54 – Updated: 2025-03-24 18:12
VLAI
Title
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT)
Summary
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-614 - Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Johnson Controls | System Configuration Tool (SCT) |
Affected:
14 , < 14.2.3
(custom)
Affected: 15 , < 15.0.3 (custom) |
Date Public
2023-02-09 18:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:00:53.815Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-21940",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-24T18:12:06.969930Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-24T18:12:16.046Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "System Configuration Tool (SCT)",
"vendor": "Johnson Controls",
"versions": [
{
"lessThan": "14.2.3",
"status": "affected",
"version": "14",
"versionType": "custom"
},
{
"lessThan": "15.0.3",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
}
],
"datePublic": "2023-02-09T18:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sensitive Cookie in HTTPS Session Without \u0027Secure\u0027 Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie."
}
],
"value": "Sensitive Cookie in HTTPS Session Without \u0027Secure\u0027 Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie."
}
],
"impacts": [
{
"capecId": "CAPEC-212",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-212 Functionality Misuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-614",
"description": "CWE-614: Sensitive Cookie in HTTPS Session Without \u0027Secure\u0027 Attribute",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-09T20:54:02.226Z",
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"shortName": "jci"
},
"references": [
{
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update SCT version 14 with patch 14.2.3"
}
],
"value": "Update SCT version 14 with patch 14.2.3"
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update SCT version 15 with patch 15.0.3\u003cbr\u003e"
}
],
"value": "Update SCT version 15 with patch 15.0.3\n"
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Contact your local Johnson Controls office or Authorized Building Control Specialists (ABCS)."
}
],
"value": "Contact your local Johnson Controls office or Authorized Building Control Specialists (ABCS)."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Sensitive Cookie in HTTPS Session Without \u0027Secure\u0027 Attribute in System Configuration Tool (SCT)",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"assignerShortName": "jci",
"cveId": "CVE-2022-21940",
"datePublished": "2023-02-09T20:54:02.226Z",
"dateReserved": "2021-12-15T20:21:18.771Z",
"dateUpdated": "2025-03-24T18:12:16.046Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-21939 (GCVE-0-2022-21939)
Vulnerability from nvd – Published: 2023-02-09 20:49 – Updated: 2025-03-24 18:19
VLAI
Title
Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)
Summary
Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-1004 - Sensitive Cookie Without 'HttpOnly' Flag
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Johnson Controls | System Configuration Tool (SCT) |
Affected:
14 , < 14.2.3
(custom)
Affected: 15 , < 15.0.3 (custom) |
Date Public
2023-02-09 18:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:00:54.427Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-21939",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-24T18:19:02.093528Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-24T18:19:12.535Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "System Configuration Tool (SCT)",
"vendor": "Johnson Controls",
"versions": [
{
"lessThan": "14.2.3",
"status": "affected",
"version": "14",
"versionType": "custom"
},
{
"lessThan": "15.0.3",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
}
],
"datePublic": "2023-02-09T18:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sensitive Cookie Without \u0027HttpOnly\u0027 Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie."
}
],
"value": "Sensitive Cookie Without \u0027HttpOnly\u0027 Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie."
}
],
"impacts": [
{
"capecId": "CAPEC-212",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-212 Functionality Misuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1004",
"description": "CWE-1004: Sensitive Cookie Without \u0027HttpOnly\u0027 Flag",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-09T20:49:17.442Z",
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"shortName": "jci"
},
"references": [
{
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update SCT version 14 with patch 14.2.3"
}
],
"value": "Update SCT version 14 with patch 14.2.3"
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update SCT version 15 with patch 15.0.3\u003cbr\u003e"
}
],
"value": "Update SCT version 15 with patch 15.0.3\n"
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Contact your local Johnson Controls office or Authorized Building Control Specialists (ABCS)."
}
],
"value": "Contact your local Johnson Controls office or Authorized Building Control Specialists (ABCS)."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Sensitive cookie without \u0027HttpOnly\u0027 flag in System Configuration Tool (SCT)",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"assignerShortName": "jci",
"cveId": "CVE-2022-21939",
"datePublished": "2023-02-09T20:49:17.442Z",
"dateReserved": "2021-12-15T20:21:18.770Z",
"dateUpdated": "2025-03-24T18:19:12.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-36203 (GCVE-0-2021-36203)
Vulnerability from nvd – Published: 2022-04-22 14:44 – Updated: 2024-09-17 02:12
VLAI
Title
Johnson Controls Metasys SCT Pro
Summary
The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request.
Severity
5.3 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-2… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Johnnson Controls | Metasys System Configuration Tool (SCT) |
Affected:
All , < 14.2.2
(custom)
|
|
| Johnnson Controls | Metasys System Configuration Tool Pro (SCT Pro) |
Affected:
All , < 14.2.2
(custom)
|
Date Public
2022-04-21 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:54:50.703Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-111-02"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Metasys System Configuration Tool (SCT)",
"vendor": "Johnnson Controls",
"versions": [
{
"lessThan": "14.2.2",
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
},
{
"product": "Metasys System Configuration Tool Pro (SCT Pro)",
"vendor": "Johnnson Controls",
"versions": [
{
"lessThan": "14.2.2",
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Tony West and Scott Ponte reported this vulnerability to Johnson Controls. Johnson Controls reported this vulnerability to CISA."
}
],
"datePublic": "2022-04-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-03T19:29:50.000Z",
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"shortName": "jci"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-111-02"
}
],
"solutions": [
{
"lang": "en",
"value": "Johnson Controls recommends users take the following steps to mitigate this vulnerability:\n\nUpdate SCT/SCT Pro with Patch 14.2.2\nTake proper steps to minimize risks to all building automation systems.\nFor more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2022-03 v1"
}
],
"source": {
"advisory": "ICSA-22-111-02",
"discovery": "EXTERNAL"
},
"title": "Johnson Controls Metasys SCT Pro",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productsecurity@jci.com",
"DATE_PUBLIC": "2022-04-21T17:00:00.000Z",
"ID": "CVE-2021-36203",
"STATE": "PUBLIC",
"TITLE": "Johnson Controls Metasys SCT Pro"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Metasys System Configuration Tool (SCT)",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "All",
"version_value": "14.2.2"
}
]
}
},
{
"product_name": "Metasys System Configuration Tool Pro (SCT Pro)",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "All",
"version_value": "14.2.2"
}
]
}
}
]
},
"vendor_name": "Johnnson Controls"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Tony West and Scott Ponte reported this vulnerability to Johnson Controls. Johnson Controls reported this vulnerability to CISA."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-918 Server-Side Request Forgery (SSRF)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-111-02",
"refsource": "MISC",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-111-02"
}
]
},
"solution": [
{
"lang": "en",
"value": "Johnson Controls recommends users take the following steps to mitigate this vulnerability:\n\nUpdate SCT/SCT Pro with Patch 14.2.2\nTake proper steps to minimize risks to all building automation systems.\nFor more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2022-03 v1"
}
],
"source": {
"advisory": "ICSA-22-111-02",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"assignerShortName": "jci",
"cveId": "CVE-2021-36203",
"datePublished": "2022-04-22T14:44:10.638Z",
"dateReserved": "2021-07-06T00:00:00.000Z",
"dateUpdated": "2024-09-17T02:12:16.472Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-9044 (GCVE-0-2020-9044)
Vulnerability from nvd – Published: 2020-03-10 19:28 – Updated: 2024-08-04 10:19
VLAI
Title
Metasys Improper Restriction of XML External Entity Reference
Summary
XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.
Severity
7.5 (High)
CWE
- CWE-611 - - Information Leak Through XML External Entity File Disclosure
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.johnsoncontrols.com/cyber-solutions/s… | x_refsource_CONFIRM |
| https://www.us-cert.gov/ics/advisories/icsa-20-070-05 | third-party-advisoryx_refsource_CERT |
Impacted products
10 products
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:19:19.812Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"name": "ICS-CERT Advisory",
"tags": [
"third-party-advisory",
"x_refsource_CERT",
"x_transferred"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-070-05"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Metasys Application and Data Server (ADS, ADS-Lite)",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "versions 10.1 and prior"
}
]
},
{
"product": "Metasys Extended Application and Data Server (ADX)",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "versions 10.1 and prior"
}
]
},
{
"product": "Metasys Open Data Server (ODS)",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "versions 10.1 and prior"
}
]
},
{
"product": "Metasys Open Application Server (OAS)",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "version 10.1"
}
]
},
{
"product": "Metasys Network Automation Engine (NAE55 only)",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "versions 9.0.1"
},
{
"status": "affected",
"version": "9.0.2"
},
{
"status": "affected",
"version": "9.0.3"
},
{
"status": "affected",
"version": "9.0.5"
},
{
"status": "affected",
"version": "9.0.6"
}
]
},
{
"product": "Metasys Network Integration Engine (NIE55/NIE59)",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "versions 9.0.1"
},
{
"status": "affected",
"version": "9.0.2"
},
{
"status": "affected",
"version": "9.0.3"
},
{
"status": "affected",
"version": "9.0.5"
},
{
"status": "affected",
"version": "9.0.6"
}
]
},
{
"product": "Metasys NAE85 and NIE85",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "versions 10.1 and prior"
}
]
},
{
"product": "Metasys LonWorks Control Server (LCS)",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "versions 10.1 and prior"
}
]
},
{
"product": "Metasys System Configuration Tool (SCT)",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "versions 13.2 and prior"
}
]
},
{
"product": "Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed)",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "version 8.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Lukasz Rupala"
}
],
"descriptions": [
{
"lang": "en",
"value": "XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls\u0027 Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 - Information Leak Through XML External Entity File Disclosure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-10T19:28:30.000Z",
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"shortName": "jci"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"name": "ICS-CERT Advisory",
"tags": [
"third-party-advisory",
"x_refsource_CERT"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-070-05"
}
],
"solutions": [
{
"lang": "en",
"value": "Johnson Controls has developed a patch to address this issue. Customers should contact their local branch office for remediation."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Metasys Improper Restriction of XML External Entity Reference",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productsecurity@jci.com",
"ID": "CVE-2020-9044",
"STATE": "PUBLIC",
"TITLE": "Metasys Improper Restriction of XML External Entity Reference"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Metasys Application and Data Server (ADS, ADS-Lite)",
"version": {
"version_data": [
{
"version_value": "versions 10.1 and prior"
}
]
}
},
{
"product_name": "Metasys Extended Application and Data Server (ADX)",
"version": {
"version_data": [
{
"version_value": "versions 10.1 and prior"
}
]
}
},
{
"product_name": "Metasys Open Data Server (ODS)",
"version": {
"version_data": [
{
"version_value": "versions 10.1 and prior"
}
]
}
},
{
"product_name": "Metasys Open Application Server (OAS)",
"version": {
"version_data": [
{
"version_value": "version 10.1"
}
]
}
},
{
"product_name": "Metasys Network Automation Engine (NAE55 only)",
"version": {
"version_data": [
{
"version_value": "versions 9.0.1"
},
{
"version_value": "9.0.2"
},
{
"version_value": "9.0.3"
},
{
"version_value": "9.0.5"
},
{
"version_value": "9.0.6"
}
]
}
},
{
"product_name": "Metasys Network Integration Engine (NIE55/NIE59)",
"version": {
"version_data": [
{
"version_value": "versions 9.0.1"
},
{
"version_value": "9.0.2"
},
{
"version_value": "9.0.3"
},
{
"version_value": "9.0.5"
},
{
"version_value": "9.0.6"
}
]
}
},
{
"product_name": "Metasys NAE85 and NIE85",
"version": {
"version_data": [
{
"version_value": "versions 10.1 and prior"
}
]
}
},
{
"product_name": "Metasys LonWorks Control Server (LCS)",
"version": {
"version_data": [
{
"version_value": "versions 10.1 and prior"
}
]
}
},
{
"product_name": "Metasys System Configuration Tool (SCT)",
"version": {
"version_data": [
{
"version_value": "versions 13.2 and prior"
}
]
}
},
{
"product_name": "Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed)",
"version": {
"version_data": [
{
"version_value": "version 8.1"
}
]
}
}
]
},
"vendor_name": "Johnson Controls"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Lukasz Rupala"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls\u0027 Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-611 - Information Leak Through XML External Entity File Disclosure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories",
"refsource": "CONFIRM",
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"name": "ICS-CERT Advisory",
"refsource": "CERT",
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-070-05"
}
]
},
"solution": [
{
"lang": "en",
"value": "Johnson Controls has developed a patch to address this issue. Customers should contact their local branch office for remediation."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"assignerShortName": "jci",
"cveId": "CVE-2020-9044",
"datePublished": "2020-03-10T19:28:30.000Z",
"dateReserved": "2020-02-18T00:00:00.000Z",
"dateUpdated": "2024-08-04T10:19:19.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-21940 (GCVE-0-2022-21940)
Vulnerability from cvelistv5 – Published: 2023-02-09 20:54 – Updated: 2025-03-24 18:12
VLAI
Title
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT)
Summary
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-614 - Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Johnson Controls | System Configuration Tool (SCT) |
Affected:
14 , < 14.2.3
(custom)
Affected: 15 , < 15.0.3 (custom) |
Date Public
2023-02-09 18:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:00:53.815Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-21940",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-24T18:12:06.969930Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-24T18:12:16.046Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "System Configuration Tool (SCT)",
"vendor": "Johnson Controls",
"versions": [
{
"lessThan": "14.2.3",
"status": "affected",
"version": "14",
"versionType": "custom"
},
{
"lessThan": "15.0.3",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
}
],
"datePublic": "2023-02-09T18:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sensitive Cookie in HTTPS Session Without \u0027Secure\u0027 Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie."
}
],
"value": "Sensitive Cookie in HTTPS Session Without \u0027Secure\u0027 Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie."
}
],
"impacts": [
{
"capecId": "CAPEC-212",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-212 Functionality Misuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-614",
"description": "CWE-614: Sensitive Cookie in HTTPS Session Without \u0027Secure\u0027 Attribute",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-09T20:54:02.226Z",
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"shortName": "jci"
},
"references": [
{
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update SCT version 14 with patch 14.2.3"
}
],
"value": "Update SCT version 14 with patch 14.2.3"
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update SCT version 15 with patch 15.0.3\u003cbr\u003e"
}
],
"value": "Update SCT version 15 with patch 15.0.3\n"
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Contact your local Johnson Controls office or Authorized Building Control Specialists (ABCS)."
}
],
"value": "Contact your local Johnson Controls office or Authorized Building Control Specialists (ABCS)."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Sensitive Cookie in HTTPS Session Without \u0027Secure\u0027 Attribute in System Configuration Tool (SCT)",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"assignerShortName": "jci",
"cveId": "CVE-2022-21940",
"datePublished": "2023-02-09T20:54:02.226Z",
"dateReserved": "2021-12-15T20:21:18.771Z",
"dateUpdated": "2025-03-24T18:12:16.046Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-21939 (GCVE-0-2022-21939)
Vulnerability from cvelistv5 – Published: 2023-02-09 20:49 – Updated: 2025-03-24 18:19
VLAI
Title
Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)
Summary
Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-1004 - Sensitive Cookie Without 'HttpOnly' Flag
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Johnson Controls | System Configuration Tool (SCT) |
Affected:
14 , < 14.2.3
(custom)
Affected: 15 , < 15.0.3 (custom) |
Date Public
2023-02-09 18:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:00:54.427Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-21939",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-24T18:19:02.093528Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-24T18:19:12.535Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "System Configuration Tool (SCT)",
"vendor": "Johnson Controls",
"versions": [
{
"lessThan": "14.2.3",
"status": "affected",
"version": "14",
"versionType": "custom"
},
{
"lessThan": "15.0.3",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
}
],
"datePublic": "2023-02-09T18:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sensitive Cookie Without \u0027HttpOnly\u0027 Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie."
}
],
"value": "Sensitive Cookie Without \u0027HttpOnly\u0027 Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie."
}
],
"impacts": [
{
"capecId": "CAPEC-212",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-212 Functionality Misuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1004",
"description": "CWE-1004: Sensitive Cookie Without \u0027HttpOnly\u0027 Flag",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-09T20:49:17.442Z",
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"shortName": "jci"
},
"references": [
{
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update SCT version 14 with patch 14.2.3"
}
],
"value": "Update SCT version 14 with patch 14.2.3"
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update SCT version 15 with patch 15.0.3\u003cbr\u003e"
}
],
"value": "Update SCT version 15 with patch 15.0.3\n"
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Contact your local Johnson Controls office or Authorized Building Control Specialists (ABCS)."
}
],
"value": "Contact your local Johnson Controls office or Authorized Building Control Specialists (ABCS)."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Sensitive cookie without \u0027HttpOnly\u0027 flag in System Configuration Tool (SCT)",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"assignerShortName": "jci",
"cveId": "CVE-2022-21939",
"datePublished": "2023-02-09T20:49:17.442Z",
"dateReserved": "2021-12-15T20:21:18.770Z",
"dateUpdated": "2025-03-24T18:19:12.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-36203 (GCVE-0-2021-36203)
Vulnerability from cvelistv5 – Published: 2022-04-22 14:44 – Updated: 2024-09-17 02:12
VLAI
Title
Johnson Controls Metasys SCT Pro
Summary
The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request.
Severity
5.3 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-2… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Johnnson Controls | Metasys System Configuration Tool (SCT) |
Affected:
All , < 14.2.2
(custom)
|
|
| Johnnson Controls | Metasys System Configuration Tool Pro (SCT Pro) |
Affected:
All , < 14.2.2
(custom)
|
Date Public
2022-04-21 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:54:50.703Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-111-02"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Metasys System Configuration Tool (SCT)",
"vendor": "Johnnson Controls",
"versions": [
{
"lessThan": "14.2.2",
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
},
{
"product": "Metasys System Configuration Tool Pro (SCT Pro)",
"vendor": "Johnnson Controls",
"versions": [
{
"lessThan": "14.2.2",
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Tony West and Scott Ponte reported this vulnerability to Johnson Controls. Johnson Controls reported this vulnerability to CISA."
}
],
"datePublic": "2022-04-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-03T19:29:50.000Z",
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"shortName": "jci"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-111-02"
}
],
"solutions": [
{
"lang": "en",
"value": "Johnson Controls recommends users take the following steps to mitigate this vulnerability:\n\nUpdate SCT/SCT Pro with Patch 14.2.2\nTake proper steps to minimize risks to all building automation systems.\nFor more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2022-03 v1"
}
],
"source": {
"advisory": "ICSA-22-111-02",
"discovery": "EXTERNAL"
},
"title": "Johnson Controls Metasys SCT Pro",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productsecurity@jci.com",
"DATE_PUBLIC": "2022-04-21T17:00:00.000Z",
"ID": "CVE-2021-36203",
"STATE": "PUBLIC",
"TITLE": "Johnson Controls Metasys SCT Pro"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Metasys System Configuration Tool (SCT)",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "All",
"version_value": "14.2.2"
}
]
}
},
{
"product_name": "Metasys System Configuration Tool Pro (SCT Pro)",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "All",
"version_value": "14.2.2"
}
]
}
}
]
},
"vendor_name": "Johnnson Controls"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Tony West and Scott Ponte reported this vulnerability to Johnson Controls. Johnson Controls reported this vulnerability to CISA."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-918 Server-Side Request Forgery (SSRF)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-111-02",
"refsource": "MISC",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-111-02"
}
]
},
"solution": [
{
"lang": "en",
"value": "Johnson Controls recommends users take the following steps to mitigate this vulnerability:\n\nUpdate SCT/SCT Pro with Patch 14.2.2\nTake proper steps to minimize risks to all building automation systems.\nFor more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2022-03 v1"
}
],
"source": {
"advisory": "ICSA-22-111-02",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"assignerShortName": "jci",
"cveId": "CVE-2021-36203",
"datePublished": "2022-04-22T14:44:10.638Z",
"dateReserved": "2021-07-06T00:00:00.000Z",
"dateUpdated": "2024-09-17T02:12:16.472Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-9044 (GCVE-0-2020-9044)
Vulnerability from cvelistv5 – Published: 2020-03-10 19:28 – Updated: 2024-08-04 10:19
VLAI
Title
Metasys Improper Restriction of XML External Entity Reference
Summary
XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.
Severity
7.5 (High)
CWE
- CWE-611 - - Information Leak Through XML External Entity File Disclosure
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.johnsoncontrols.com/cyber-solutions/s… | x_refsource_CONFIRM |
| https://www.us-cert.gov/ics/advisories/icsa-20-070-05 | third-party-advisoryx_refsource_CERT |
Impacted products
10 products
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:19:19.812Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"name": "ICS-CERT Advisory",
"tags": [
"third-party-advisory",
"x_refsource_CERT",
"x_transferred"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-070-05"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Metasys Application and Data Server (ADS, ADS-Lite)",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "versions 10.1 and prior"
}
]
},
{
"product": "Metasys Extended Application and Data Server (ADX)",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "versions 10.1 and prior"
}
]
},
{
"product": "Metasys Open Data Server (ODS)",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "versions 10.1 and prior"
}
]
},
{
"product": "Metasys Open Application Server (OAS)",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "version 10.1"
}
]
},
{
"product": "Metasys Network Automation Engine (NAE55 only)",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "versions 9.0.1"
},
{
"status": "affected",
"version": "9.0.2"
},
{
"status": "affected",
"version": "9.0.3"
},
{
"status": "affected",
"version": "9.0.5"
},
{
"status": "affected",
"version": "9.0.6"
}
]
},
{
"product": "Metasys Network Integration Engine (NIE55/NIE59)",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "versions 9.0.1"
},
{
"status": "affected",
"version": "9.0.2"
},
{
"status": "affected",
"version": "9.0.3"
},
{
"status": "affected",
"version": "9.0.5"
},
{
"status": "affected",
"version": "9.0.6"
}
]
},
{
"product": "Metasys NAE85 and NIE85",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "versions 10.1 and prior"
}
]
},
{
"product": "Metasys LonWorks Control Server (LCS)",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "versions 10.1 and prior"
}
]
},
{
"product": "Metasys System Configuration Tool (SCT)",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "versions 13.2 and prior"
}
]
},
{
"product": "Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed)",
"vendor": "Johnson Controls",
"versions": [
{
"status": "affected",
"version": "version 8.1"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Lukasz Rupala"
}
],
"descriptions": [
{
"lang": "en",
"value": "XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls\u0027 Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 - Information Leak Through XML External Entity File Disclosure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-10T19:28:30.000Z",
"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"shortName": "jci"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"name": "ICS-CERT Advisory",
"tags": [
"third-party-advisory",
"x_refsource_CERT"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-070-05"
}
],
"solutions": [
{
"lang": "en",
"value": "Johnson Controls has developed a patch to address this issue. Customers should contact their local branch office for remediation."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Metasys Improper Restriction of XML External Entity Reference",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productsecurity@jci.com",
"ID": "CVE-2020-9044",
"STATE": "PUBLIC",
"TITLE": "Metasys Improper Restriction of XML External Entity Reference"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Metasys Application and Data Server (ADS, ADS-Lite)",
"version": {
"version_data": [
{
"version_value": "versions 10.1 and prior"
}
]
}
},
{
"product_name": "Metasys Extended Application and Data Server (ADX)",
"version": {
"version_data": [
{
"version_value": "versions 10.1 and prior"
}
]
}
},
{
"product_name": "Metasys Open Data Server (ODS)",
"version": {
"version_data": [
{
"version_value": "versions 10.1 and prior"
}
]
}
},
{
"product_name": "Metasys Open Application Server (OAS)",
"version": {
"version_data": [
{
"version_value": "version 10.1"
}
]
}
},
{
"product_name": "Metasys Network Automation Engine (NAE55 only)",
"version": {
"version_data": [
{
"version_value": "versions 9.0.1"
},
{
"version_value": "9.0.2"
},
{
"version_value": "9.0.3"
},
{
"version_value": "9.0.5"
},
{
"version_value": "9.0.6"
}
]
}
},
{
"product_name": "Metasys Network Integration Engine (NIE55/NIE59)",
"version": {
"version_data": [
{
"version_value": "versions 9.0.1"
},
{
"version_value": "9.0.2"
},
{
"version_value": "9.0.3"
},
{
"version_value": "9.0.5"
},
{
"version_value": "9.0.6"
}
]
}
},
{
"product_name": "Metasys NAE85 and NIE85",
"version": {
"version_data": [
{
"version_value": "versions 10.1 and prior"
}
]
}
},
{
"product_name": "Metasys LonWorks Control Server (LCS)",
"version": {
"version_data": [
{
"version_value": "versions 10.1 and prior"
}
]
}
},
{
"product_name": "Metasys System Configuration Tool (SCT)",
"version": {
"version_data": [
{
"version_value": "versions 13.2 and prior"
}
]
}
},
{
"product_name": "Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed)",
"version": {
"version_data": [
{
"version_value": "version 8.1"
}
]
}
}
]
},
"vendor_name": "Johnson Controls"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Lukasz Rupala"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls\u0027 Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-611 - Information Leak Through XML External Entity File Disclosure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories",
"refsource": "CONFIRM",
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"name": "ICS-CERT Advisory",
"refsource": "CERT",
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-070-05"
}
]
},
"solution": [
{
"lang": "en",
"value": "Johnson Controls has developed a patch to address this issue. Customers should contact their local branch office for remediation."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
"assignerShortName": "jci",
"cveId": "CVE-2020-9044",
"datePublished": "2020-03-10T19:28:30.000Z",
"dateReserved": "2020-02-18T00:00:00.000Z",
"dateUpdated": "2024-08-04T10:19:19.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}