Skip to content
OpenAdvisories
High ICSA-22-165-01 3 CVEs

Johnson Controls Metasys ADS ADX OAS Servers

Published Jun 14, 2022 · Updated Jun 14, 2022

Vendor: Johnson Controls Product: All Metasys ADS/ADX/OAS

Summary

Successful exploitation of these vulnerabilities could allow unauthorized users to compromise passwords and inject malicious code into web interfaces.

Vulnerabilities 3

  • High 8.7
    CVE-2022-21937

    Metasys CSS

    Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 could allow a user to inject malicious code into the web interface.

    Johnson Controls Metasys ADS/ADX/OAS server
  • High 8.1
    CVE-2022-21938

    Metasys MUI Graphics XSS

    Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 could allow a user to inject malicious code into the MUI Graphics web interface.

    Johnson Controls Metasys ADS/ADX/OAS server
  • High 7.5
    CVE-2022-21935

    Metasys password guessing

    A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change.

    Johnson Controls Metasys ADS/ADX/OAS server

Revision history

  1. #1

    ICSA-22-165-01 Johnson Controls Metasys ADS ADX OAS Servers

References