« Volver al listado

CVE-2021-36207

Estado: ModificadaAlta (8.8)—

Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated user to elevate their privileges to administrator.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Johnsoncontrols — Metasys Application AND Data ServerJohnsoncontrols — Metasys Extended Application AND Data ServerJohnsoncontrols — Metasys Open Application Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-36207",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 8.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "productsecurity@jci.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "productsecurity@jci.com",
      "affectedData": [
        {
          "vendor": "Johnson Controls",
          "product": "Metasys ADS/ADX/OAS server",
          "versions": [
            {
              "status": "affected",
              "version": "All 10 versions",
              "lessThan": "10.1.5",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "All 11 versions",
              "lessThan": "11.0.2",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-04-29T17:15:19.777",
  "references": [
    {
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-118-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "productsecurity@jci.com"
    },
    {
      "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "productsecurity@jci.com"
    },
    {
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-118-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productsecurity@jci.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated user to elevate their privileges to administrator."
    },
    {
      "lang": "es",
      "value": "Bajo determinadas circunstancias una administración de privilegios inapropiada en los servidores Metasys ADS/ADX/OAS versiones 10 y 11, podría permitir a un usuario autenticado elevar sus privilegios a administrador"
    }
  ],
  "lastModified": "2026-06-17T03:58:31.683",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:johnsoncontrols:metasys_application_and_data_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "269B868C-D8D5-4726-BD49-9B25DA149188",
              "versionEndExcluding": "10.1.5",
              "versionStartIncluding": "10.0"
            },
            {
              "criteria": "cpe:2.3:a:johnsoncontrols:metasys_application_and_data_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EA242516-72AD-4835-BE94-662CECD1DF78",
              "versionEndExcluding": "11.0.2",
              "versionStartIncluding": "11.0"
            },
            {
              "criteria": "cpe:2.3:a:johnsoncontrols:metasys_extended_application_and_data_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7F46EAB9-4A55-4488-A7A2-79FE4B0CA66F",
              "versionEndExcluding": "10.1.5",
              "versionStartIncluding": "10.0"
            },
            {
              "criteria": "cpe:2.3:a:johnsoncontrols:metasys_extended_application_and_data_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B02A5890-8965-4CB6-B009-9C741D4D97F4",
              "versionEndExcluding": "11.0.2",
              "versionStartIncluding": "11.0"
            },
            {
              "criteria": "cpe:2.3:a:johnsoncontrols:metasys_open_application_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E3CC754C-B8D2-4CE0-AC12-1B53CB71055D",
              "versionEndExcluding": "10.1.5",
              "versionStartIncluding": "10.0"
            },
            {
              "criteria": "cpe:2.3:a:johnsoncontrols:metasys_open_application_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16B43D40-5D24-4011-B5E3-676EF38C2751",
              "versionEndExcluding": "11.0.2",
              "versionStartIncluding": "11.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "productsecurity@jci.com"
}