PT-2023-12673 · Johnson Controls · Johnson Controls System Configuration Tool
CVE-2022-21939
·
Publicado
2023-02-09
·
Atualizado
2023-06-27
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Johnson Controls System Configuration Tool (SCT) versions 14 prior to 14.2.3
Johnson Controls System Configuration Tool (SCT) versions 15 prior to 15.0.3
Description
The issue allows access to a sensitive cookie due to the lack of the 'HttpOnly' flag. This could potentially compromise the security of the system.
Recommendations
For Johnson Controls System Configuration Tool (SCT) versions 14 prior to 14.2.3, update to version 14.2.3 or later.
For Johnson Controls System Configuration Tool (SCT) versions 15 prior to 15.0.3, update to version 15.0.3 or later.
Correção
Incorrect Permission
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Johnson Controls System Configuration Tool