Lucene search

JciCVELIST:CVE-2023-2025

HistoryMay 18, 2023 - 8:50 p.m.

CVE-2023-2025 Exposure of Sensitive Information in OpenBlue Enterprise Manager Data Collector

2023-05-1820:50:36

CWE-200

jci

www.cve.org

cve-2023-2025

openblue

data collector

sensitive information

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

45.5%

JSON

OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 may expose sensitive information to an unauthorized user under certain circumstances.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "OpenBlue Enterprise Manager Data Collector",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "lessThan": "3.2.5.75",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-23-138-04

www.johnsoncontrols.com/cyber-solutions/security-advisories

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

45.5%

JSON

Related for CVELIST:CVE-2023-2025