CVE-2022-21939: Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)
First published: Thu Feb 09 2023(Updated: )
Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.
Credit: productsecurity@jci.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Johnsoncontrols Metasys System Configuration Tool | >=14.0<14.2.3 | |
| Johnsoncontrols Metasys System Configuration Tool | >=15.0<15.0.3 | |
| Johnson Controls System Configuration Tool (SCT) version 14 | <14.2.3 | 14.2.3 |
| Johnson Controls System Configuration Tool (SCT) version 15 | <15.0.3 | 15.0.3 |
Remedy
Update SCT version 14 with patch 14.2.3
Remedy
Update SCT version 15 with patch 15.0.3
Remedy
Contact your local Johnson Controls office or Authorized Building Control Specialists (ABCS).
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-21939?
CVE-2022-21939 is a vulnerability in Johnson Controls System Configuration Tool (SCT) versions 14.0 to 14.2.3 and versions 15.0 to 15.0.3.
What is the severity of CVE-2022-21939?
The severity of CVE-2022-21939 is high with a CVSS score of 6.1.
What is the description of CVE-2022-21939?
CVE-2022-21939 is a Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) that could allow unauthorized access to the cookie.
Which software versions are affected by CVE-2022-21939?
Johnson Controls System Configuration Tool (SCT) versions 14 prior to 14.2.3 and versions 15 prior to 15.0.3 are affected by CVE-2022-21939.
How can I fix CVE-2022-21939?
To fix CVE-2022-21939, update Johnson Controls System Configuration Tool (SCT) to version 14.2.3 or 15.0.3 or later.
- collector/nvd-index
- agent/weakness
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/author
- agent/remedy
- agent/description
- agent/first-publish-date
- agent/severity
- agent/references
- agent/event
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/trending
- vendor/johnsoncontrols
- canonical/johnsoncontrols metasys system configuration tool
- version/johnsoncontrols metasys system configuration tool/14.0
- version/johnsoncontrols metasys system configuration tool/15.0
- vendor/johnson controls
- canonical/johnson controls system configuration tool (sct) version 14
- canonical/johnson controls system configuration tool (sct) version 15