Ccure 9000 And Victor Application Server
Monthly
Server-Side Request Forgery in Johnson Controls CCure 9000 and the victor application server (versions 2.9 through 3.0) allows a high-privileged authenticated attacker to coerce the server into issuing crafted requests to internal or external systems. Exploitation can expose internal network resources and pivot into otherwise unreachable back-end services, with high confidentiality impact and a scope change that affects downstream systems. This is a vendor-reported (jci) issue with no public exploit identified at time of analysis and no CISA KEV listing.
Server-Side Request Forgery in Johnson Controls CCure 9000 and the victor application server (versions 2.9 through 3.0) allows a high-privileged authenticated attacker to coerce the server into issuing crafted requests to internal or external systems. Exploitation can expose internal network resources and pivot into otherwise unreachable back-end services, with high confidentiality impact and a scope change that affects downstream systems. This is a vendor-reported (jci) issue with no public exploit identified at time of analysis and no CISA KEV listing.