CVE-2021-36207 Metasys privilege management

What is CVE-2021-36207?

CVE-2021-36207 is a high-severity vulnerability in Johnson Controls Metasys ADS/ADX/OAS server, published on 29 Apr 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated user to elevate their privileges to administrator.

Weakness: CWE-269

Which versions are affected by CVE-2021-36207?

It affects 3 products.

Products include Johnsoncontrols Metasys Application and Data Server, Johnsoncontrols Metasys Extended Application and Data Server, Johnsoncontrols Metasys Open Application Server.

How do I fix CVE-2021-36207?

No fix has been published for CVE-2021-36207 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-36207 being exploited?

There is no known exploitation of CVE-2021-36207 in the wild and no public exploit code.

Other vulnerabilities in Johnson Controls Metasys ADS/ADX/OAS server

• CVE-2022-21937 Metasys CSS High 8.7
• CVE-2021-36202 Metasys UI High 8.4
• CVE-2022-21938 Metasys MUI Graphics XSS High 8.1
• CVE-2021-36205 Metasys session token High 8.1
• CVE-2022-21934 Metasys Unverified Password Change High 8.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2375-ph49-69c5.