5.3
CVE-2021-36200
- EPSS 0.55%
- Veröffentlicht 22.07.2022 15:15:07
- Zuletzt bearbeitet 21.11.2024 06:13:18
- Quelle productsecurity@jci.com
- CVE-Watchlists
- Unerledigt
LoginMetasys ADS/ADX/OAS with MUI
Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Johnsoncontrols ≫ Metasys Application And Data Server Version >= 10.0 < 10.1.6
Johnsoncontrols ≫ Metasys Application And Data Server Version >= 11.0 < 11.0.2
Johnsoncontrols ≫ Metasys Extended Application And Data Server Version >= 10.0 < 10.1.6
Johnsoncontrols ≫ Metasys Extended Application And Data Server Version >= 11.0 < 11.0.2
Johnsoncontrols ≫ Metasys Open Application Server Version >= 10.0 < 10.1.6
Johnsoncontrols ≫ Metasys Open Application Server Version >= 11.0 < 11.0.2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.55% | 0.415 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
| productsecurity@jci.com | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
CWE-306 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
https://www.johnsoncontrols.com/cyber-solutions/security-advisories
https://www.cisa.gov/uscert/ics/advisories/icsa-22-202-02