CVE-2022-21939
7.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Johnson Controls | System Configuration Tool (SCT) | 14 < 14.2.3 | affected |
| Johnson Controls | System Configuration Tool (SCT) | 15 < 15.0.3 | affected |
Weaknesses
- CWE-1004: CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
ADP Enrichment
CVE Program Container
Additional References
- https://www.johnsoncontrols.com/cyber-solutions/security-advisories
- https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
- https://www.johnsoncontrols.com/cyber-solutions/security-advisories
- https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.