cve.bz

CVE-2022-21939

6.1 mediumEPSS 0.5%

Medium (6.1) in johnsoncontrols metasys system configuration tool. EPSS 0.5% chance of exploitation in the next 30 days.

Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

Severity

CVSS 3.1

6.1 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
CWEs
CWE-732, CWE-1004
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON