CVE-2022-21934 Metasys Unverified Password Change

What is CVE-2022-21934?

CVE-2022-21934 is a high-severity authentication bypass vulnerability in Johnson Controls Metasys ADS/ADX/OAS server, published on 6 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS server 11 versions prior to 11.0.2.

Weakness: CWE-287, CWE-620

Which versions are affected by CVE-2022-21934?

It affects 3 products.

Products include Johnsoncontrols Metasys Application and Data Server, Johnsoncontrols Metasys Extended Application and Data Server, Johnsoncontrols Metasys Open Application Server.

How do I fix CVE-2022-21934?

No fix has been published for CVE-2022-21934 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-21934 being exploited?

There is no known exploitation of CVE-2022-21934 in the wild and no public exploit code.

Other vulnerabilities in Johnson Controls Metasys ADS/ADX/OAS server

• CVE-2021-36207 Metasys privilege management High 8.8
• CVE-2022-21937 Metasys CSS High 8.7
• CVE-2021-36202 Metasys UI High 8.4
• CVE-2022-21938 Metasys MUI Graphics XSS High 8.1
• CVE-2021-36205 Metasys session token High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m2gh-9wqr-8vqc.