Vulnerability · Published Feb 9, 2023 · Assigned by jci
CVE-2022-21940Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT)
High 7.5
In plain English
A high-severity security flaw in System Configuration Tool (SCT) from Johnson Controls. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 68.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Johnson Controls | System Configuration Tool (SCT) | 14 – before 14.2.315 – before 15.0.3 |
Weakness: CWE-614 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H