CVE-2021-36202 Metasys UI

What is CVE-2021-36202?

CVE-2021-36202 is a high-severity server-side request forgery vulnerability in Johnson Controls Metasys, published on 7 Apr 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code into the MUI PDF export feature. This issue affects: Johnson Controls Metasys All 10 versions versions prior to 10.1.5; All 11 versions versions prior to 11.0.2.

Weakness: CWE-918

Which versions are affected by CVE-2021-36202?

It affects 3 products.

Products include Johnsoncontrols Metasys Application and Data Server, Johnsoncontrols Metasys Extended Application and Data Server, Johnsoncontrols Metasys Open Application Server.

How do I fix CVE-2021-36202?

No fix has been published for CVE-2021-36202 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2021-36202 being exploited?

There is no known exploitation of CVE-2021-36202 in the wild and no public exploit code.

Other vulnerabilities in Johnson Controls Metasys

• CVE-2021-36207 Metasys privilege management High 8.8
• CVE-2022-21937 Metasys CSS High 8.7
• CVE-2022-21938 Metasys MUI Graphics XSS High 8.1
• CVE-2021-36205 Metasys session token High 8.1
• CVE-2022-21934 Metasys Unverified Password Change High 8.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-89fc-cvxq-q6pv.