CVE-2021-36201

2022-10-1121:15:12

CWE-204

CWE-203

[email protected]

web.nvd.nist.gov

ccure portal

user accounts

enumeration

vulnerability

ccure 9000

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

32.2%

JSON

Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions.

Affected configurations

Nvd

Node

johnsoncontrolsc-cure_9000Match-

AND

johnsoncontrolsc-cure_9000_firmwareRange≤2.90

VendorProductVersionCPE
johnsoncontrolsc-cure_9000-cpe:2.3:h:johnsoncontrols:c-cure_9000:-:*:*:*:*:*:*:*
johnsoncontrolsc-cure_9000_firmware*cpe:2.3:o:johnsoncontrols:c-cure_9000_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
johnsoncontrols	c-cure_9000	-	cpe:2.3:h:johnsoncontrols:c-cure_9000:-:::::::*
johnsoncontrols	c-cure_9000_firmware	*	cpe:2.3:o:johnsoncontrols:c-cure_9000_firmware::::::::