CVEvulnerability

CVE-2022-21940

6.1 MEDIUM Published 2023-02-09 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-02-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-311, CWE-614

Description

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

Affected configurations

• johnsoncontrols metasys system configuration tool (>= 14.0 < 14.2.3) • johnsoncontrols metasys system configuration tool (>= 15.0 < 15.0.3)

Related

Weakness · CWE (2)

  • CWE-311 Missing Encryption of Sensitive Data weakness
  • CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute weakness

References