CVE-2021-36202

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF export feature. This issue affects: Johnson Controls Metasys All 10 versions versions prior to 10.1.5; All 11 versions versions prior to 11.0.2.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Johnson Controls	Metasys	>= All 10 versions, < 10.1.5; >= All 11 versions, < 11.0.2

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-095-02Third Party Advisory, US Government Resource
https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesVendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-095-02Third Party Advisory, US Government Resource
https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesVendor Advisory

Timeline

Published: Apr 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-362039.1The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request.CVE-2021-362047.5Under some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 10 versions prior to CVE-2021-362059.8Under certain circumstances the session token is not cleared on logout.CVE-2021-362066.1All versions of CEVAS prior to 1.01.46 do not sufficiently validate user-controllable input and could allow a user to bypass authentication CVE-2021-362078.8Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated use CVE-2021-362099.8In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset.CVE-2021-36218.8A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands CVE-2021-362126.1app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view.CVE-2021-362137.5HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action can CVE-2021-362146.1LINE client for iOS before 10.16.3 allows cross site script with specific header in WebView.CVE-2021-362155.3LINE client for iOS 10.21.3 and before allows address bar spoofing due to inappropriate address handling.CVE-2021-362167.8LINE for Windows 6.2.1.2289 and before allows arbitrary code execution via malicious DLL injection.