PT-2023-12265 · Johnson Controls · Metasys Ads/Adx/Oas

CVE-2021-36204 · Publicado 2023-01-13 · Atualizado 2023-01-23

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Johnson Controls Metasys ADS/ADX/OAS versions prior to 10.1.6 Johnson Controls Metasys ADS/ADX/OAS versions prior to 11.0.3

Description An Insufficiently Protected Credentials issue allows API calls to expose credentials in plain text under certain circumstances.

Recommendations For versions prior to 10.1.6, update to version 10.1.6 or later. For versions prior to 11.0.3, update to version 11.0.3 or later.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2021-36204

Produtos afetados

Metasys Ads/Adx/Oas

Referências · 8

• https://t.me/cvenotify/42673 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2021-36204 · Aviso do Fabricante
• https://johnsoncontrols.com/cyber-solutions/security-advisories · Aviso do Fabricante
• https://t.me/cvenotify/41990 · Publicação no Telegram
• https://t.me/cvenotify/42143 · Publicação no Telegram
• https://cisa.gov/uscert/ics/advisories/icsa-23-012-06 · Nota
• https://t.me/cibsecurity/56496 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2021-36204 · Nota de Segurança