Lucene search
JciCVELIST:CVE-2022-21939HistoryFeb 09, 2023 - 8:49 p.m.
CVE-2022-21939 Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)
2023-02-0920:49:17
CWE-1004
jci
www.cve.org
3
sensitive cookie
system configuration tool
vulnerability
johnson controls
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
35.8%
Sensitive Cookie Without ‘HttpOnly’ Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "System Configuration Tool (SCT)",
"vendor": "Johnson Controls",
"versions": [
{
"lessThan": "14.2.3",
"status": "affected",
"version": "14",
"versionType": "custom"
},
{
"lessThan": "15.0.3",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
}
]Related
cve
cve
CVE-2022-21939
2023-02-09 21:15:11
nvd
nvd
CVE-2022-21939
2023-02-09 21:15:11
prion
prion
Design/Logic Flaw
2023-02-09 21:15:00
ics
ics
Johnson Controls System Configuration Tool (SCT)
2023-02-09 12:00:00
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
35.8%
Related for CVELIST:CVE-2022-21939