CVE-2022-21935

Name of the Vulnerable Software and Affected Versions Metasys Application and Data Server (ADS) versions prior to 10.1.5 Metasys Extended Application and Data Server (ADX) versions prior to 10.1.5 Metasys Extended Application and Data Server (ADX) versions prior to 11.0.2 Metasys Application and Data Server (ADS) versions prior to 11.0.2 Metasys Open Application Server (OAS) (affected versions not specified)

Description The issue is related to the lack of necessary checks when removing a password. This can allow a remote attacker to execute arbitrary code by exploiting the vulnerability, potentially enabling unverified password changes.

Recommendations For Metasys ADS versions prior to 10.1.5, update to version 10.1.5 or later. For Metasys ADX versions prior to 10.1.5, update to version 10.1.5 or later. For Metasys ADS versions prior to 11.0.2, update to version 11.0.2 or later. For Metasys ADX versions prior to 11.0.2, update to version 11.0.2 or later. For Metasys OAS, at the moment, there is no information about a newer version that contains a fix for this vulnerability.