Skip to content
OpenAdvisories
Medium ICSA-22-202-02 1 CVE

Johnson Controls Metasys ADS, ADX, OAS

Published Jul 21, 2022 · Updated Jul 21, 2022

Vendor: Johnson Controls Product: Metasys ADS ADX OAS with MUI

Summary

Successful exploitation of this vulnerability could allow an unauthenticated user to access Metasys web API and enumerate users.

Vulnerabilities 1

  • Medium 5.3
    CVE-2021-36200

    Metasys ADS/ADX/OAS with MUI

    Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users.

    Johnson Controls Metasys ADS/ADX/OAS server

Revision history

  1. #1

    Publication Date

References