High ICSA-21-049-01 1 CVE

Johnson Controls Metasys Reporting Engine (MRE) Web Services

Published Feb 18, 2021 · Updated Feb 18, 2021

Vendor: Johnson Controls Product: Metasys Reporting Engine (MRE)

Summary

Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to access and download arbitrary files from the system.

Vulnerabilities 1

High 7.5

CVE-2020-9050

Metasys Reporting Engine (MRE) Web Services - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Path Traversal vulnerability exists in Metasys Reporting Engine (MRE) Web Services which could allow a remote unauthenticated attacker to access and download arbitrary files from the system.

Johnson Controls Metasys Reporting Engine (MRE) Web Services versions 2.0 and 2.1

Feb 19, 2021

Revision history

2021-02-18 #1
ICSA-21-049-01 Johnson Controls Metasys Reporting Engine (MRE) Web Services

References

ICS Advisory ICSA-21-049-01 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-049-01
Recommended Practices
https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B