Medium severity · published Feb 9, 2023
CVE-2022-21940
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to…
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Metasys System Configuration Tool · Johnsoncontrols
14.0 before 14.2.3; 15.0 before 15.0.3 · source: NVD
Affected product
MS
Metasys System Configuration Tool
Johnsoncontrols
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-21940
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-21940
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03
Vendor Advisory
https://www.johnsoncontrols.com/cyber-solutions/security-advisories
More from Metasys System Configuration Tool
9.1
CVE-2021-36203
The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request
9.1
CVE-2020-9044
XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files
6.1
CVE-2022-21939
Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow…