CVE-2022-21940 - Vulnerability Details - OpenCVE

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Johnsoncontrols	Metasys System Configuration Tool

Configuration 1 [-]

OR	cpe:2.3:a:johnsoncontrols:metasys_system_configuration_tool::::::::
	cpe:2.3:a:johnsoncontrols:metasys_system_configuration_tool::::::::

No data.

References

Link	Providers
https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03
https://www.johnsoncontrols.com/cyber-solutions/security-advisories

History

Mon, 24 Mar 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: jci

Published: 2023-02-09T20:54:02.226Z

Updated: 2025-03-24T18:12:16.046Z

Reserved: 2021-12-15T20:21:18.771Z

Link: CVE-2022-21940

Vulnrichment

Updated: 2024-08-03T03:00:53.815Z

NVD

Status : Modified

Published: 2023-02-09T21:15:11.213

Modified: 2024-11-21T06:45:45.053

Link: CVE-2022-21940

Redhat

No data.

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories", "tags": ["x_transferred"]}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:00:53.815Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-21940", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-24T18:12:06.969930Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-24T18:12:11.656Z"}}], "cna": {"title": "Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT)", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-212", "descriptions": [{"lang": "en", "value": "CAPEC-212 Functionality Misuse"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Johnson Controls", "product": "System Configuration Tool (SCT)", "versions": [{"status": "affected", "version": "14", "lessThan": "14.2.3", "versionType": "custom"}, {"status": "affected", "version": "15", "lessThan": "15.0.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update SCT version 14 with patch 14.2.3", "supportingMedia": [{"type": "text/html", "value": "Update SCT version 14 with patch 14.2.3", "base64": false}]}, {"lang": "en", "value": "Update SCT version 15 with patch 15.0.3\n", "supportingMedia": [{"type": "text/html", "value": "Update SCT version 15 with patch 15.0.3<br>", "base64": false}]}, {"lang": "en", "value": "Contact your local Johnson Controls office or Authorized Building Control Specialists (ABCS).", "supportingMedia": [{"type": "text/html", "value": "Contact your local Johnson Controls office or Authorized Building Control Specialists (ABCS).", "base64": false}]}], "datePublic": "2023-02-09T18:00:00.000Z", "references": [{"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.", "supportingMedia": [{"type": "text/html", "value": "Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-614", "description": "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"}]}], "providerMetadata": {"orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01", "shortName": "jci", "dateUpdated": "2023-02-09T20:54:02.226Z"}}}, "cveMetadata": {"cveId": "CVE-2022-21940", "state": "PUBLISHED", "dateUpdated": "2025-03-24T18:12:16.046Z", "dateReserved": "2021-12-15T20:21:18.771Z", "assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01", "datePublished": "2023-02-09T20:54:02.226Z", "assignerShortName": "jci"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:johnsoncontrols:metasys_system_configuration_tool:*:*:*:*:*:*:*:*", "matchCriteriaId": "857E45A1-DF8B-4EB1-9A0D-3CC4EA5AE0A3", "versionEndExcluding": "14.2.3", "versionStartIncluding": "14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:johnsoncontrols:metasys_system_configuration_tool:*:*:*:*:*:*:*:*", "matchCriteriaId": "3FC5B276-EFB2-4CBF-AEA0-3FBF6CB94930", "versionEndExcluding": "15.0.3", "versionStartIncluding": "15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie."}], "id": "CVE-2022-21940", "lastModified": "2024-11-21T06:45:45.053", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "productsecurity@jci.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-02-09T21:15:11.213", "references": [{"source": "productsecurity@jci.com", "tags": ["Third Party Advisory", "US Government Resource", "VDB Entry"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03"}, {"source": "productsecurity@jci.com", "tags": ["Vendor Advisory"], "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource", "VDB Entry"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"}], "sourceIdentifier": "productsecurity@jci.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-614"}], "source": "productsecurity@jci.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-311"}], "source": "nvd@nist.gov", "type": "Primary"}]}