CVE-2022-21939 - Vulnerability Details - OpenCVE

Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00121.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Johnsoncontrols	Metasys System Configuration Tool

Configuration 1 [-]

OR	cpe:2.3:a:johnsoncontrols:metasys_system_configuration_tool::::::::
	cpe:2.3:a:johnsoncontrols:metasys_system_configuration_tool::::::::

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2022-27095	Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

Fixes

Solution

Update SCT version 14 with patch 14.2.3

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03
https://www.johnsoncontrols.com/cyber-solutions/security-advisories

History

Mon, 24 Mar 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: jci

Published: 2023-02-09T20:49:17.442Z

Updated: 2025-03-24T18:19:12.535Z

Reserved: 2021-12-15T20:21:18.770Z

Link: CVE-2022-21939

Vulnrichment

Updated: 2024-08-03T03:00:54.427Z

NVD

Status : Modified

Published: 2023-02-09T21:15:11.123

Modified: 2024-11-21T06:45:44.913

Link: CVE-2022-21939

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories", "tags": ["x_transferred"]}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:00:54.427Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-21939", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-24T18:19:02.093528Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-24T18:18:51.839Z"}}], "cna": {"title": "Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-212", "descriptions": [{"lang": "en", "value": "CAPEC-212 Functionality Misuse"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Johnson Controls", "product": "System Configuration Tool (SCT)", "versions": [{"status": "affected", "version": "14", "lessThan": "14.2.3", "versionType": "custom"}, {"status": "affected", "version": "15", "lessThan": "15.0.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update SCT version 14 with patch 14.2.3", "supportingMedia": [{"type": "text/html", "value": "Update SCT version 14 with patch 14.2.3", "base64": false}]}, {"lang": "en", "value": "Update SCT version 15 with patch 15.0.3\n", "supportingMedia": [{"type": "text/html", "value": "Update SCT version 15 with patch 15.0.3<br>", "base64": false}]}, {"lang": "en", "value": "Contact your local Johnson Controls office or Authorized Building Control Specialists (ABCS).", "supportingMedia": [{"type": "text/html", "value": "Contact your local Johnson Controls office or Authorized Building Control Specialists (ABCS).", "base64": false}]}], "datePublic": "2023-02-09T18:00:00.000Z", "references": [{"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.", "supportingMedia": [{"type": "text/html", "value": "Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1004", "description": "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag"}]}], "providerMetadata": {"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01", "shortName": "jci", "dateUpdated": "2023-02-09T20:49:17.442Z"}}}, "cveMetadata": {"cveId": "CVE-2022-21939", "state": "PUBLISHED", "dateUpdated": "2025-03-24T18:19:12.535Z", "dateReserved": "2021-12-15T20:21:18.770Z", "assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01", "datePublished": "2023-02-09T20:49:17.442Z", "assignerShortName": "jci"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:johnsoncontrols:metasys_system_configuration_tool:*:*:*:*:*:*:*:*", "matchCriteriaId": "857E45A1-DF8B-4EB1-9A0D-3CC4EA5AE0A3", "versionEndExcluding": "14.2.3", "versionStartIncluding": "14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:johnsoncontrols:metasys_system_configuration_tool:*:*:*:*:*:*:*:*", "matchCriteriaId": "3FC5B276-EFB2-4CBF-AEA0-3FBF6CB94930", "versionEndExcluding": "15.0.3", "versionStartIncluding": "15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie."}], "id": "CVE-2022-21939", "lastModified": "2024-11-21T06:45:44.913", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "productsecurity@jci.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-02-09T21:15:11.123", "references": [{"source": "productsecurity@jci.com", "tags": ["Third Party Advisory", "US Government Resource", "VDB Entry"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03"}, {"source": "productsecurity@jci.com", "tags": ["Vendor Advisory"], "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource", "VDB Entry"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}], "sourceIdentifier": "productsecurity@jci.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1004"}], "source": "productsecurity@jci.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-732"}], "source": "nvd@nist.gov", "type": "Primary"}]}