VULNERABILITY INTELLIGENCE

CVE-2022-21940

CVSS score7.5 HIGH

EPSS probability0.37%

CISA KEVNot currently listed

Published2023-02-09

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

Weakness classification

productsecurity@jci.com: CWE-614
nvd@nist.gov: CWE-311

Primary references

productsecurity@jci.com — Third Party Advisory, US Government Resource, VDB Entry
productsecurity@jci.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory