CVE-2022-21938: Metasys MUI Graphics XSS
Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 could allow a user to inject malicious code into the MUI Graphics web interface.
Affected Software
Remediation
Information
Information
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-21938.
What is the severity of CVE-2022-21938?
CVE-2022-21938 has a severity of high (5.4).
Which software versions are affected by CVE-2022-21938?
Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 are affected by CVE-2022-21938.
How can a user exploit CVE-2022-21938?
Under certain circumstances, a user can inject malicious code into the MUI Graphics web interface of the affected software (Metasys ADS/ADX/OAS).
Where can I find more information about CVE-2022-21938?
You can find more information about CVE-2022-21938 at the following references: [CISA Advisory](https://www.cisa.gov/uscert/ics/advisories/icsa-22-165-01) and [Johnson Controls Security Advisories](https://www.johnsoncontrols.com/cyber-solutions/security-advisories).