Vulnerability · Published Feb 9, 2023 · Assigned by jci
CVE-2022-21939Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)
High 7.5
In plain English
A high-severity security flaw in System Configuration Tool (SCT) from Johnson Controls. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 54.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Johnson Controls | System Configuration Tool (SCT) | 14 – before 14.2.315 – before 15.0.3 |
Weakness: CWE-1004 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H