fkie_nvd - fkie_cve-2021-27657

FKIE_CVE-2021-27657

Vulnerability from fkie_nvd - Published: 2021-06-04 15:15 - Updated: 2024-11-21 05:58

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. This issue affects: Johnson Controls Metasys version 11.0 and prior versions.

References

URL	Tags
productsecurity@jci.com	https://us-cert.cisa.gov/ics/advisories/icsa-21-159-01	Third Party Advisory, US Government Resource
productsecurity@jci.com	https://us-cert.gov/ics/advisories	Third Party Advisory, US Government Resource
productsecurity@jci.com	https://www.johnsoncontrols.com/cyber-solutions/security-advisories	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://us-cert.cisa.gov/ics/advisories/icsa-21-159-01	Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108	https://us-cert.gov/ics/advisories	Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108	https://www.johnsoncontrols.com/cyber-solutions/security-advisories	Vendor Advisory

Impacted products

	Vendor	Product	Version
	johnsoncontrols	metasys	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:johnsoncontrols:metasys:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5F7AFA8-0BE3-4B4E-BECA-7A51700003CD",
              "versionEndIncluding": "11.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. This issue affects: Johnson Controls Metasys version 11.0 and prior versions."
    },
    {
      "lang": "es",
      "value": "Una explotaci\u00f3n con \u00e9xito de esta vulnerabilidad podr\u00eda otorgar a un usuario autenticado de Metasys un nivel de acceso no intencionado al sistema de archivos del servidor, permiti\u00e9ndole acceder o modificar los archivos del sistema mediante el env\u00edo de mensajes web espec\u00edficamente dise\u00f1ados para el sistema Metasys. Este problema afecta: Johnson Controls Metasys versiones 11.0 y versiones anteriores"
    }
  ],
  "id": "CVE-2021-27657",
  "lastModified": "2024-11-21T05:58:23.307",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "productsecurity@jci.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-06-04T15:15:07.517",
  "references": [
    {
      "source": "productsecurity@jci.com",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-159-01"
    },
    {
      "source": "productsecurity@jci.com",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://us-cert.gov/ics/advisories"
    },
    {
      "source": "productsecurity@jci.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-159-01"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://us-cert.gov/ics/advisories"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
    }
  ],
  "sourceIdentifier": "productsecurity@jci.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ],
      "source": "productsecurity@jci.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2021-27657 (GCVE-0-2021-27657)

Vulnerability from cvelistv5 – Published: 2021-06-04 14:07 – Updated: 2024-09-17 00:51

Summary

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-269 - Improper Privilege Management

Assigner

jci

References

URL

Tags

	https://www.johnsoncontrols.com/cyber-solutions/s…	x_refsource_CONFIRM
	https://us-cert.gov/ics/advisories	third-party-advisoryx_refsource_CERT
	https://us-cert.cisa.gov/ics/advisories/icsa-21-159-01	third-party-advisoryx_refsource_CERT

Impacted products

	Vendor	Product	Version
	Johnson Controls	Metasys	Affected: 11.0 , ≤ 11.0 (custom)

Credits

Jakub Palaczynski

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T21:26:10.694Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
          },
          {
            "name": "ICS-CERT Advisory",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "https://us-cert.gov/ics/advisories"
          },
          {
            "name": "ICS-CERT Advisory",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-159-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Metasys",
          "vendor": "Johnson Controls",
          "versions": [
            {
              "lessThanOrEqual": "11.0",
              "status": "affected",
              "version": "11.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Jakub Palaczynski"
        }
      ],
      "datePublic": "2021-06-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. This issue affects: Johnson Controls Metasys version 11.0 and prior versions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-23T10:45:14",
        "orgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
        "shortName": "jci"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
        },
        {
          "name": "ICS-CERT Advisory",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "https://us-cert.gov/ics/advisories"
        },
        {
          "name": "ICS-CERT Advisory",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-159-01"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "For Metasys versions previous to 9.0: Upgrade to a supported release. This is true for all the items except for Metasys Release 8.1 UL/cUL 864 UUKL 10th Edition Smoke Control."
        },
        {
          "lang": "en",
          "value": "For Metasys versions 9.0 (engine only), 10.0, 10.1, 11.0: Install patch."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Metasys Improper Privilege Management",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "productsecurity@jci.com",
          "DATE_PUBLIC": "2021-06-04T05:01:00.000Z",
          "ID": "CVE-2021-27657",
          "STATE": "PUBLIC",
          "TITLE": "Metasys Improper Privilege Management"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Metasys",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "11.0",
                            "version_value": "11.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Johnson Controls"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Jakub Palaczynski"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. This issue affects: Johnson Controls Metasys version 11.0 and prior versions."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-269 Improper Privilege Management"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories",
              "refsource": "CONFIRM",
              "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
            },
            {
              "name": "ICS-CERT Advisory",
              "refsource": "CERT",
              "url": "https://us-cert.gov/ics/advisories"
            },
            {
              "name": "ICS-CERT Advisory",
              "refsource": "CERT",
              "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-159-01"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "For Metasys versions previous to 9.0: Upgrade to a supported release. This is true for all the items except for Metasys Release 8.1 UL/cUL 864 UUKL 10th Edition Smoke Control."
          },
          {
            "lang": "en",
            "value": "For Metasys versions 9.0 (engine only), 10.0, 10.1, 11.0: Install patch."
          }
        ],
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7281d04a-a537-43df-bfb4-fa4110af9d01",
    "assignerShortName": "jci",
    "cveId": "CVE-2021-27657",
    "datePublished": "2021-06-04T14:07:39.073279Z",
    "dateReserved": "2021-02-24T00:00:00",
    "dateUpdated": "2024-09-17T00:51:44.651Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2021-27657

CVE-2021-27657 (GCVE-0-2021-27657)

Tags

Sightings

Nomenclature