Skip to main content

Metasys Application And Data Server CVE-2022-21935

HIGH
Unverified Password Change (CWE-620)
2022-06-15 productsecurity@jci.com
Information Disclosure Metasys Application And Data Server Metasys Extended Application And Data Server Metasys Open Application Server
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

1
CVE Published
Jun 15, 2022 - 20:15 nvd
HIGH 7.5

DescriptionNVD

A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change.

AnalysisAI

A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-620. A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change. Affected products include: Johnsoncontrols Metasys Application And Data Server, Johnsoncontrols Metasys Extended Application And Data Server, Johnsoncontrols Metasys Open Application Server. Version information: prior to 10.1.5.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Metasys Application And Data Server

View all
CVE-2020-9044 CRITICAL
9.1 Mar 10

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks
CVE-2022-21934 HIGH
8.8 May 06

Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts i
CVE-2022-21938 MEDIUM
5.4 Jun 15

Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS

CVE-2022-21937 MEDIUM
5.4 Jun 15

Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS

Same weakness CWE-620 – Unverified Password Change

View all
CVE-2024-12824 CRITICAL POC
9.8
CVE-2025-4322 CRITICAL POC
9.8
CVE-2024-20419 CRITICAL POC
10.0
CVE-2023-2297 CRITICAL POC
9.8
CVE-2025-63362 CRITICAL POC
9.8
CVE-2023-3069 CRITICAL POC
9.8
CVE-2020-7378 CRITICAL POC
9.1
CVE-2024-33699 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2022-21935 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy