HIGH🇵🇱 Wersja polska

CVE-2021-36204

CVSS 7.8v3.1pub. 2023-01-13upd. 2024-11-21

Under some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.3 allows API calls to expose credentials in plain text.

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  • Johnsoncontrols Metasys Application And Data Server

    APP
    Johnsoncontrols
    10.0 – 10.1.6 (bez)11.0 – 11.0.3 (bez)

  • Johnsoncontrols Metasys Extended Application And Data Server

    APP
    Johnsoncontrols
    10.0 – 10.1.6 (bez)11.0 – 11.0.3 (bez)

  • Johnsoncontrols Metasys Open Application Server

    APP
    Johnsoncontrols
    10.0 – 10.1.6 (bez)11.0 – 11.0.3 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-21936HIGH8.1ten sam produkt

On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions witho...

CVE-2022-21935HIGH7.5ten sam produkt

A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior t...

CVE-2022-21938HIGH8.1ten sam produkt

Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys AD...

CVE-2022-21937HIGH8.7ten sam produkt

Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys AD...

CVE-2022-21934HIGH8.0ten sam produkt

Under certain circumstances an authenticated user could lock other users out of the system or take over their ...