CVE-2021-36203
Assigner: jci
Published: 2022-04-21T00:00:00
State: PUBLISHED
affected: product: Metasys System Configuration Tool (SCT)
vendor: Johnnson Controls
versions: lessThan: 14.2.2
status: affected
version: All
versionType: custom
product: Metasys System Configuration Tool Pro (SCT Pro)
vendor: Johnnson Controls
versions: lessThan: 14.2.2
status: affected
version: All
versionType: custom
credits: value: Tony West and Scott Ponte reported this vulnerability to Johnson Controls. Johnson Controls reported this vulnerability to CISA.
datePublic: 2022-04-21T00:00:00
descriptions: value: The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
type: CWE
solutions: value: Johnson Controls recommends users take the following steps to mitigate this vulnerability:

Update SCT/SCT Pro with Patch 14.2.2
Take proper steps to minimize risks to all building automation systems.
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2022-03 v1
source: advisory: ICSA-22-111-02 
discovery: EXTERNAL
title: Johnson Controls Metasys SCT Pro
x_generator: engine: Vulnogram 0.0.9