PT-2023-12674 · Johnson Controls · Johnson Controls System Configuration Tool

Published 2023-02-09 · Updated 2023-06-27 · CVE-2022-21940

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Johnson Controls System Configuration Tool (SCT) versions 14 prior to 14.2.3 Johnson Controls System Configuration Tool (SCT) versions 15 prior to 15.0.3

Description The issue allows access to a sensitive cookie in an HTTPS session due to the lack of the 'Secure' attribute. This could potentially compromise the security of the session.

Recommendations For versions 14 prior to 14.2.3, update to version 14.2.3 or later. For versions 15 prior to 15.0.3, update to version 15.0.3 or later.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

CWE-614

Related Identifiers

CVE-2022-21940

Affected Products

Johnson Controls System Configuration Tool

References · 5

• https://osv.dev/vulnerability/CVE-2022-21940 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21940 · Security Note
• https://johnsoncontrols.com/cyber-solutions/security-advisories · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-23-040-03 · Note
• https://t.me/cibsecurity/57905 · Telegram Post