Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2022-21939

Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
jci

Description

Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Johnson Controls System Configuration Tool (SCT)

Default version status: unaffected

  • 14 to < 14.2.3affected
  • 15 to < 15.0.3affected

References