Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)
Priority LOW 36CWE-1004Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00546 46th percentileScored 2026-11-07
Fix Fixed System Configuration Tool (SCT) (Johnson Controls): 14.2.3, 15.0.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Johnson Controls | System Configuration Tool (SCT) | 14 to before 14.2.3; 15 to before 15.0.3 | 14.2.3, 15.0.3 | Patch available | CNA |
- System Configuration Tool (SCT) VendorJohnson Controls Affected 14 to before 14.2.3; 15 to before 15.0.3 Fixed in 14.2.3, 15.0.3 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:johnsoncontrols:metasys_system_configuration_tool:*:*:*:*:*:*:*:* | 14.0 to before 14.2.3; 15.0 to before 15.0.3 | Vulnerable | Johnson Controls |
- cpe:2.3:a:johnsoncontrols:metasys_system_configuration_tool:*:*:*:*:*:*:*:* Versions 14.0 to before 14.2.3; 15.0 to before 15.0.3 Vulnerable ·Johnson Controls
Remediation
- Fix · CNA System Configuration Tool (SCT) (Johnson Controls) Fixed in 14.2.3, 15.0.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Johnson Controls System Configuration Tool (SCT) 14.2.3, 15.0.3
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2022-06304 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT)Priority LOW 35
Timeline
- 2026-10-02 Threatist record created from CVE-2022-21939
- 2026-10-03 Alias added: GHSA-mw9r-vp4h-34mp
References
More Johnson Controls Metasys System Configuration Tool vulnerabilities
- TI-2020-07260 Metasys Improper Restriction of XML External Entity Reference CVSS 3.1CRITICAL 9.1
- TI-2021-14619 Johnson Controls Metasys SCT Pro CVSS 3.1CRITICAL 9.1
- TI-2022-06304 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT) CVSS 3.1HIGH 7.5
Sources
- CVE-2022-21939 · CVE Program
- CVE-2022-21939 · NVD
- FIRST EPSS
- GHSA-mw9r-vp4h-34mp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences