Vulnerabilities > CVE-2021-36202 - Server-Side Request Forgery (SSRF) vulnerability in Johnsoncontrols products

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

SINGLE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

low complexity

johnsoncontrols

CWE-918

NVD

Published: 2022-04-07

Updated: 2022-04-14

Summary

Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF export feature. This issue affects: Johnson Controls Metasys All 10 versions versions prior to 10.1.5; All 11 versions versions prior to 11.0.2.

Vulnerable Configurations

Part	Description	Count
Application	Johnsoncontrols Johnsoncontrols Metasys Application AND Data Server 10.1 Johnsoncontrols Metasys Application AND Data Server * Johnsoncontrols Metasys Extended Application AND Data Server 10.1 Johnsoncontrols Metasys Extended Application AND Data Server * Johnsoncontrols Metasys Open Application Server 10.1 Johnsoncontrols Metasys Open Application Server 11.0	7

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References