Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2022-21940

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
jci

Description

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Johnson Controls System Configuration Tool (SCT)

Default version status: unaffected

  • 14 to < 14.2.3affected
  • 15 to < 15.0.3affected

References