CVE-2018-10624 Johnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive Information

2018-07-3100:00:00

CWE-209

icscert

www.cve.org

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.2%

JSON

In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communications with the server, which could allow an attacker to obtain technical information.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Metasys System",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "lessThanOrEqual": "8.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "BCPro (BCM)",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "lessThan": "3.0.2",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]