CVE-2022-21937: Metasys CSS
Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 could allow a user to inject malicious code into the web interface.
Affected Software
Remediation
Information
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for this Metasys vulnerability?
The vulnerability ID for this Metasys vulnerability is CVE-2022-21937.
What is the severity of CVE-2022-21937?
The severity of CVE-2022-21937 is high with a CVSS score of 5.4.
Which versions of Metasys are affected by CVE-2022-21937?
Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 are affected by CVE-2022-21937.
How can a user exploit CVE-2022-21937?
Under certain circumstances, a user can inject malicious code into the web interface of Metasys ADS/ADX/OAS versions prior to 10.1.5 and 11.0.2.
Where can I find more information about CVE-2022-21937?
You can find more information about CVE-2022-21937 on the following websites: [CISA.gov](https://www.cisa.gov/uscert/ics/advisories/icsa-22-165-01) and [Johnson Controls](https://www.johnsoncontrols.com/cyber-solutions/security-advisories).