CVE-2021-36200

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
Johnson Controls	Metasys ADS/ADX/OAS server	>= All 10 versions, < 10.1.6; >= All 11 versions, < 11.0.2

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-202-02Mitigation, Third Party Advisory, US Government Resource
https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesVendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-202-02Mitigation, Third Party Advisory, US Government Resource
https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesVendor Advisory

Timeline

Published: Jul 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-362015.3Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions.CVE-2021-362028.8Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code CVE-2021-362039.1The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request.CVE-2021-362047.5Under some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 10 versions prior to CVE-2021-362059.8Under certain circumstances the session token is not cleared on logout.CVE-2021-362066.1All versions of CEVAS prior to 1.01.46 do not sufficiently validate user-controllable input and could allow a user to bypass authentication CVE-2021-362078.8Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated use CVE-2021-362099.8In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset.CVE-2021-36218.8A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands CVE-2021-362126.1app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view.CVE-2021-362137.5HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action can CVE-2021-362146.1LINE client for iOS before 10.16.3 allows cross site script with specific header in WebView.