CVE-2022-21939

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-1004 CWE-732

Affected software

Vendor	Product	Versions
Johnson Controls	System Configuration Tool (SCT)	>= 14, < 14.2.3; >= 15, < 15.0.3

References

https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03Third Party Advisory, US Government Resource, VDB Entry
https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesVendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03Third Party Advisory, US Government Resource, VDB Entry
https://www.johnsoncontrols.com/cyber-solutions/security-advisoriesVendor Advisory

Timeline

Published: Feb 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-21944.8The Accept Stripe Payments WordPress plugin before 2.0.64 does not sanitize and escape some of its settings, allowing high privilege users s CVE-2022-219406.1Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 pr CVE-2022-219419.8All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root CVE-2022-219447.8A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory al CVE-2022-219456.1A Insecure Temporary File vulnerability in cscreen of openSUSE Factory allows local attackers to cause DoS for cscreen and a system DoS for CVE-2022-219465.3A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any CVE-2022-219478.8A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dash CVE-2022-219486.1An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in paste allows remote attackers to pl CVE-2022-219498.8A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference extern CVE-2022-219505.3A Improper Access Control vulnerability in the systemd service of cana in openSUSE Backports SLE-15-SP3, openSUSE Backports SLE-15-SP4 allow CVE-2022-219516.8A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change CVE-2022-219527.5A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows re