CVE-2018-10624 Johnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive Information

2018-08-0121:00:00

CWE-209

icscert

www.cve.org

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

21.0%

JSON

In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communications with the server, which could allow an attacker to obtain technical information.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Metasys System",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "lessThanOrEqual": "8.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "BCPro (BCM)",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "lessThan": "3.0.2",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]