Lucene search

JciCVELIST:CVE-2021-36200

HistoryJul 22, 2022 - 2:55 p.m.

CVE-2021-36200 Metasys ADS/ADX/OAS with MUI

2022-07-2214:55:52

CWE-306

jci

www.cve.org

cve-2021-36200

metasys

unauthenticated access

web api

user enumeration

security vulnerability

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

34.5%

JSON

Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users.

CNA Affected

[
  {
    "product": "Metasys ADS/ADX/OAS server",
    "vendor": "Johnson Controls",
    "versions": [
      {
        "lessThan": "10.1.6",
        "status": "affected",
        "version": "All 10 versions",
        "versionType": "custom"
      },
      {
        "lessThan": "11.0.2",
        "status": "affected",
        "version": "All 11 versions",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsa-22-202-02

www.johnsoncontrols.com/cyber-solutions/security-advisories

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

34.5%

JSON

Related for CVELIST:CVE-2021-36200