CVE-2021-36200 — MEDIUM (5.3)

Q: What is CVE-2021-36200?

CVE-2021-36200 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users.

Q: How severe is CVE-2021-36200?

CVE-2021-36200 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2021-36200?

Check the references section above for vendor advisories and patch information. Affected products include: Johnsoncontrols Metasys Application And Data Server, Johnsoncontrols Metasys Extended Application And Data Server, Johnsoncontrols Metasys Open Application Server.

Vulnerability Description

Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Johnsoncontrols	Metasys Application And Data Server	>= 10.0, < 10.1.6
Johnsoncontrols	Metasys Extended Application And Data Server	>= 10.0, < 10.1.6
Johnsoncontrols	Metasys Open Application Server	>= 10.0, < 10.1.6

Related Weaknesses (CWE)

CWE-306

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-202-02MitigationThird Party AdvisoryUS Government Resource
https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesVendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-202-02MitigationThird Party AdvisoryUS Government Resource
https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesVendor Advisory

FAQ

What is CVE-2021-36200?

CVE-2021-36200 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users.

How severe is CVE-2021-36200?

CVE-2021-36200 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-36200?

Check the references section above for vendor advisories and patch information. Affected products include: Johnsoncontrols Metasys Application And Data Server, Johnsoncontrols Metasys Extended Application And Data Server, Johnsoncontrols Metasys Open Application Server.