Lucene search

[email protected]CVE-2023-2025

HistoryMay 18, 2023 - 9:15 p.m.

CVE-2023-2025

2023-05-1821:15:09

CWE-200

CWE-668

[email protected]

web.nvd.nist.gov

openblue

enterprise manager

data collector

cve-2023-2025

nvd

security vulnerabilty

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.5%

JSON

OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 may expose sensitive information to an unauthorized user under certain circumstances.

Affected configurations

NVD

Node

johnsoncontrolsopenblue_enterprise_manager_data_collectorRange<3.2.5.75

CPENameOperatorVersion
johnsoncontrols:openblue_enterprise_manager_data_collectorjohnsoncontrols openblue enterprise manager data collectorlt3.2.5.75

CPE	Name	Operator	Version
johnsoncontrols:openblue_enterprise_manager_data_collector	johnsoncontrols openblue enterprise manager data collector	lt	3.2.5.75

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "OpenBlue Enterprise Manager Data Collector",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "lessThan": "3.2.5.75",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-23-138-04

www.johnsoncontrols.com/cyber-solutions/security-advisories

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.5%

JSON

Related for CVE-2023-2025

prion1 nvd1 cvelist1 ics1