CVE Vulnerabilities

CVE-2021-36205

Incomplete Cleanup

Published: Apr 15, 2022 | Modified: Apr 25, 2022
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
6.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

Under certain circumstances the session token is not cleared on logout.

Weakness

The product does not properly “clean up” and remove temporary or supporting resources after they have been used.

Affected Software

Name Vendor Start Version End Version
Metasys_application_and_data_server Johnsoncontrols 10.0 (including) 10.1.5 (excluding)
Metasys_application_and_data_server Johnsoncontrols 11.0 (including) 11.0.2 (excluding)
Metasys_extended_application_and_data_server Johnsoncontrols 10.0 (including) 10.1.5 (excluding)
Metasys_extended_application_and_data_server Johnsoncontrols 11.0 (including) 11.0.2 (excluding)
Metasys_open_application_server Johnsoncontrols 10.0 (including) 10.1.5 (excluding)
Metasys_open_application_server Johnsoncontrols 11.0 (including) 11.0.2 (excluding)

Potential Mitigations

References