Skip to content
OpenAdvisories
High ICSA-24-135-03 1 CVE

Johnson Controls Software House C●CURE 9000

Published May 14, 2024 · Updated May 14, 2024

Vendor: Johnson Controls Product: Software House C●CURE 9000

Summary

Successful exploitation of this vulnerability may allow an attacker to access credentials used for access to the application.

Vulnerabilities 1

  • High 8.5
    CVE-2024-0912

    CCURE passwords exposed to administrators

    Under certain circumstances the Microsoft® Internet Information Server (IIS) used to host the C•CURE 9000 Web Server will log Microsoft Windows credential details within logs. There is no impact to non-web service interfaces C•CURE 9000 or prior versions

    Johnson Controls Software House C•CURE 9000

Revision history

  1. #1

    Initial Publication

References