Design/Logic Flaw

2023-02-0921:15:00

PRIOn knowledge base

www.prio-n.com

logic flaw

design flaw

sensitive information

cookie security

version 14

version 15

access control

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.5%

JSON

Sensitive Cookie Without ‘HttpOnly’ Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

CPENameOperatorVersion
metasys_system_configuration_toolge15.0
metasys_system_configuration_toollt15.0.3
metasys_system_configuration_toolge14.0
metasys_system_configuration_toollt14.2.3

Name	Operator	Version
metasys_system_configuration_tool	ge	15.0
metasys_system_configuration_tool	lt	15.0.3
metasys_system_configuration_tool	ge	14.0
metasys_system_configuration_tool	lt	14.2.3