CVE-2022-21934

🗓️ 06 May 2022 15:55:23Reported by jciType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 75 Views

CVE-2022-21934: Authenticated user lockout or account takeover in Metasys serve

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2022-21934	5 May 202219:36	–	attackerkb
Circl	CVE-2022-21934	6 May 202220:22	–	circl
CNNVD	Johnson Controls Metasys ADS/ADX/OAS servers 授权问题漏洞	5 May 202200:00	–	cnnvd
Cvelist	CVE-2022-21934 Metasys Unverified Password Change	6 May 202215:55	–	cvelist
EUVD	EUVD-2022-27090	3 Oct 202520:07	–	euvd
ICS	Johnson Controls Metasys	5 May 202200:00	–	ics
NVD	CVE-2022-21934	6 May 202216:15	–	nvd
OSV	CVE-2022-21934	6 May 202216:15	–	osv
Prion	Code injection	6 May 202216:15	–	prion

NVD

Node

johnsoncontrols metasys_application_and_data_serverRange10.0–10.1.5

johnsoncontrols metasys_application_and_data_serverRange11.0–11.0.2

johnsoncontrols metasys_extended_application_and_data_serverRange10.0–10.1.5

johnsoncontrols metasys_extended_application_and_data_serverRange11.0–11.0.2

johnsoncontrols metasys_open_application_serverRange10.0–10.1.5

johnsoncontrols metasys_open_application_serverRange11.0–11.0.2

[
  {
    "product": "Metasys ADS/ADX/OAS server",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "lessThan": "10.1.5",
        "status": "affected",
        "version": "All 10 versions",
        "versionType": "custom"
      },
      {
        "lessThan": "11.0.2",
        "status": "affected",
        "version": "All 11 versions",
        "versionType": "custom"
      }
    ]
  }
]