Lucene search

JciCVELIST:CVE-2021-36206

HistoryOct 28, 2022 - 1:17 a.m.

CVE-2021-36206 CEVAS

2022-10-2801:17:27

CWE-79

jci

www.cve.org

cevas

version 1.01.46

input validation

authentication bypass

sql queries

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

9.9

Confidence

High

EPSS

0.001

Percentile

40.1%

JSON

All versions of CEVAS prior to 1.01.46 do not sufficiently validate user-controllable input and could allow a user to bypass authentication and retrieve data with specially crafted SQL queries.

CNA Affected

[
  {
    "vendor": "Johnson Controls",
    "product": "CEVAS",
    "versions": [
      {
        "version": "all versions prior to 1.01.46",
        "status": "affected",
        "lessThan": "1.01.46",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsa-22-298-05

www.johnsoncontrols.com/cyber-solutions/security-advisories

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

9.9

Confidence

High

EPSS

0.001

Percentile

40.1%

JSON

Related for CVELIST:CVE-2021-36206