Описание
The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request.
Ссылки
- Third Party AdvisoryUS Government Resource
- Third Party AdvisoryUS Government Resource
Уязвимые конфигурации
Конфигурация 1Версия до 14.2.2 (исключая)Версия до 14.2.2 (исключая)
Одно из
cpe:2.3:a:johnsoncontrols:metasys_system_configuration_tool:*:*:*:*:-:*:*:*
cpe:2.3:a:johnsoncontrols:metasys_system_configuration_tool:*:*:*:*:pro:*:*:*
EPSS
Процентиль: 38%
0.00168
Низкий
5.3 Medium
CVSS3
9.1 Critical
CVSS3
6.4 Medium
CVSS2
Дефекты
CWE-918
CWE-918
Связанные уязвимости
CVSS3: 9.1
github
почти 4 года назад
A vulnerability in all versions of SCT/SCT Pro prior to version 14.2.2 allows a remote unauthenticated attacker to identify and forge requests to internal systems via a specially crafted request allowing the attacker to determine if specific files or paths exist. This issue affects all versions of SCT/SCT Pro prior to version 14.2.2.
EPSS
Процентиль: 38%
0.00168
Низкий
5.3 Medium
CVSS3
9.1 Critical
CVSS3
6.4 Medium
CVSS2
Дефекты
CWE-918
CWE-918