Server side request forgery (ssrf)

2022-04-0720:15:00

PRIOn knowledge base

www.prio-n.com

8.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.9%

JSON

Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF export feature. This issue affects: Johnson Controls Metasys All 10 versions versions prior to 10.1.5; All 11 versions versions prior to 11.0.2.

CPENameOperatorVersion
metasys_application_and_data_serverge11.0
metasys_application_and_data_serverlt11.0.2
metasys_application_and_data_serverge10.0
metasys_application_and_data_serverlt10.1.5
metasys_extended_application_and_data_serverge11.0
metasys_extended_application_and_data_serverlt11.0.2
metasys_extended_application_and_data_serverge10.0
metasys_extended_application_and_data_serverlt10.1.5
metasys_open_application_serverge11.0
metasys_open_application_serverlt11.0.2

Name	Operator	Version
metasys_application_and_data_server	ge	11.0
metasys_application_and_data_server	lt	11.0.2
metasys_application_and_data_server	ge	10.0
metasys_application_and_data_server	lt	10.1.5
metasys_extended_application_and_data_server	ge	11.0
metasys_extended_application_and_data_server	lt	11.0.2
metasys_extended_application_and_data_server	ge	10.0
metasys_extended_application_and_data_server	lt	10.1.5
metasys_open_application_server	ge	11.0
metasys_open_application_server	lt	11.0.2