VULNERABILITY INTELLIGENCE

CVE-2022-21939

CVSS score7.5 HIGH

EPSS probability0.55%

CISA KEVNot currently listed

Published2023-02-09

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

Weakness classification

productsecurity@jci.com: CWE-1004
nvd@nist.gov: CWE-732

Primary references

productsecurity@jci.com — Third Party Advisory, US Government Resource, VDB Entry
productsecurity@jci.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory