Skip to main content

Metasys Application And Data Server CVE-2022-21934

HIGH
Unverified Password Change (CWE-620)
2022-05-06 productsecurity@jci.com
Information Disclosure Metasys Application And Data Server Metasys Extended Application And Data Server Metasys Open Application Server
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
May 06, 2022 - 16:15 nvd
HIGH 8.8

DescriptionNVD

Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS server 11 versions prior to 11.0.2.

AnalysisAI

Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 versions prior to 10.1.5 and Metasys. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-620. Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS server 11 versions prior to 11.0.2. Affected products include: Johnsoncontrols Metasys Application And Data Server, Johnsoncontrols Metasys Extended Application And Data Server, Johnsoncontrols Metasys Open Application Server. Version information: prior to 10.1.5.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Metasys Application And Data Server

View all
CVE-2020-9044 CRITICAL
9.1 Mar 10

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks
CVE-2022-21935 HIGH
7.5 Jun 15

A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 a
CVE-2022-21938 MEDIUM
5.4 Jun 15

Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS

CVE-2022-21937 MEDIUM
5.4 Jun 15

Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS

Same weakness CWE-620 – Unverified Password Change

View all
CVE-2024-12824 CRITICAL POC
9.8
CVE-2025-4322 CRITICAL POC
9.8
CVE-2024-20419 CRITICAL POC
10.0
CVE-2023-2297 CRITICAL POC
9.8
CVE-2025-63362 CRITICAL POC
9.8
CVE-2023-3069 CRITICAL POC
9.8
CVE-2020-7378 CRITICAL POC
9.1
CVE-2024-33699 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2022-21934 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy