PT-2023-12673 · Johnson Controls · Johnson Controls System Configuration Tool

CVE-2022-21939 · Published 2023-02-09 · Updated 2023-06-27

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Johnson Controls System Configuration Tool (SCT) versions 14 prior to 14.2.3 Johnson Controls System Configuration Tool (SCT) versions 15 prior to 15.0.3

Description The issue allows access to a sensitive cookie due to the lack of the 'HttpOnly' flag. This could potentially compromise the security of the system.

Recommendations For Johnson Controls System Configuration Tool (SCT) versions 14 prior to 14.2.3, update to version 14.2.3 or later. For Johnson Controls System Configuration Tool (SCT) versions 15 prior to 15.0.3, update to version 15.0.3 or later.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

CWE-1004

Related Identifiers

CVE-2022-21939

Affected Products

Johnson Controls System Configuration Tool

References · 5

• https://osv.dev/vulnerability/CVE-2022-21939 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21939 · Security Note
• https://johnsoncontrols.com/cyber-solutions/security-advisories · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-23-040-03 · Note
• https://t.me/cibsecurity/57901 · Telegram Post