CVE-2020-9044 Metasys Improper Restriction of XML External Entity Reference
An XXE vulnerability in Johnson Controls Metasys web services allows attackers to cause denial of service or read server files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-9044?
CVE-2020-9044 is a high-severity vulnerability in Johnson Controls Metasys Application and Data Server (ADS, ADS-Lite), published on 10 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.
Weakness: CWE-611
Which versions are affected by CVE-2020-9044?
It affects 13 products.
Products include Johnsoncontrols Metasys Application and Data Server, Johnsoncontrols Metasys Extended Application and Data Server, Johnsoncontrols Metasys Lonworks Control Server, Johnsoncontrols Metasys Open Application Server, Johnsoncontrols Metasys Open Data Server, Johnsoncontrols Metasys System Configuration Tool and 7 more.
How do I fix CVE-2020-9044?
No fix has been published for CVE-2020-9044 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-9044 being exploited?
There is no known exploitation of CVE-2020-9044 in the wild and no public exploit code.
Other vulnerabilities in Johnson Controls Metasys Application and Data Server (ADS, ADS-Lite)
Sources
Also known as GHSA-gfgf-64cp-gxh7.