Lucene search

JciCVE-2022-21936

HistoryOct 07, 2022 - 6:15 p.m.

CVE-2022-21936

2022-10-0718:15:14

CWE-287

jci

web.nvd.nist.gov

cve-2022-21936

metasys adx server

mve

active directory

unauthorized access

vulnerability

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS

0.001

Percentile

22.7%

JSON

On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP UI.

Affected configurations

Nvd

Node

johnsoncontrolsmetasys_extended_application_and_data_serverMatch12.0

AND

johnsoncontrolsmetasys_for_validated_environmentsMatch-

VendorProductVersionCPE
johnsoncontrolsmetasys_extended_application_and_data_server12.0cpe:2.3:a:johnsoncontrols:metasys_extended_application_and_data_server:12.0:*:*:*:*:*:*:*
johnsoncontrolsmetasys_for_validated_environments-cpe:2.3:a:johnsoncontrols:metasys_for_validated_environments:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
johnsoncontrols	metasys_extended_application_and_data_server	12.0	cpe:2.3:a:johnsoncontrols:metasys_extended_application_and_data_server:12.0:::::::*
johnsoncontrols	metasys_for_validated_environments	-	cpe:2.3:a:johnsoncontrols:metasys_for_validated_environments:-:::::::*

References

www.cisa.gov/uscert/ics/advisories/icsa-22-277-01

www.johnsoncontrols.com/cyber-solutions/security-advisories

Social References

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS

0.001

Percentile

22.7%

JSON

Related for CVE-2022-21936