dbcve.org
Metasys System Configuration ToolApplication · Johnsoncontrols

CVE-2022-21939

MEDIUM · 6.1 CVSS v3.1 Published 2023-02-09
Fix available
A fix is available. Upgrade to 14.2.3 / 15.0.3 or later.
See remediation →
68/100
Remediation priority · Elevated
Remotely reachable No privileges

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The Johnson Controls System Configuration Tool (SCT) versions 14 prior to 14.2.3 and 15 prior to 15.0.3 sets sensitive cookies (likely session cookies) without the HttpOnly flag. This allows client-side JavaScript to access these cookies, potentially enabling session hijacking via cross-site scripting (XSS) attacks.

MitigationUpdate Johnson Controls SCT to version 14.2.3 or 15.0.3 or later to receive the patched version that includes the HttpOnly flag on sensitive cookies.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Metasys System Configuration ToolApplication
Affected:>= 14.0, < 14.2.3>= 15.0, < 15.0.3

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Locate Johnson Controls SCT installation
    Check common installation paths such as C:\Program Files\Johnson Controls\Metasys System Configuration Tool or C:\Program Files (x86)\Johnson Controls\Metasys System Configuration Tool. Also check the Windows Registry under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall for entries containing 'Metasys' or 'System Configuration Tool'.
    Affected if SCT is found installed on the system
  2. Determine installed SCT version
    Open the installed application or check its About/Properties window. Look for a version number in the format X.Y.Z (such as 14.0.0, 14.2.0, 15.0.0, 15.0.2).
    Affected if Version cannot be determined or does not match the installed application details
  3. Compare version against affected ranges
    Compare your installed version number to the affected ranges: versions 14.0.0 through 14.2.2 (inclusive), or versions 15.0.0 through 15.0.2 (inclusive). Versions 14.2.3 and above, or 15.0.3 and above, are not affected.
    Affected if Installed version falls within 14.0.0 to 14.2.2 OR 15.0.0 to 15.0.2
  4. Identify if web interface is accessible
    If SCT includes a web-based interface, access it via browser (commonly localhost on a specific port) while the application is running. Use browser developer tools (F12) to inspect cookies being set.
    Affected if Web interface is accessible and you can observe cookie headers in HTTP responses
  5. Verify HttpOnly flag on cookies
    In browser developer tools, check the Cookies tab or inspect Set-Cookie response headers. Look for the presence or absence of the HttpOnly attribute on session-related cookies.
    Affected if Session cookies are set without the HttpOnly attribute, allowing JavaScript access

You are affected if the installed SCT version is 14.0.0-14.2.2 or 15.0.0-15.0.2 and the web interface exposes cookies without the HttpOnly flag.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 14.2.3 / 15.0.3 or later
Fixed in 14.2.315.0.3
Interim mitigation

Update Johnson Controls SCT to version 14.2.3 or 15.0.3 or later to receive the patched version that includes the HttpOnly flag on sensitive cookies.

Recommended fix High confidence

Metasys System Configuration Tool 14.2.3 (for 14.x users) or 15.0.3 (for 15.x users)

  1. Identify current Metasys System Configuration Tool version in use
  2. Backup current SCT configuration and any associated data before proceeding
  3. Download Metasys System Configuration Tool version 14.2.3 (if currently on 14.x branch) or version 15.0.3 (if currently on 15.x branch) from the official Johnson Controls download portal or support site
  4. Install or upgrade to the downloaded fixed version following standard Johnson Controls installation procedures
  5. After upgrade, verify that cookies are now set with the HttpOnly flag by inspecting HTTP response headers or consulting release notes
  6. Confirm the SCT application functions normally after the update
Caveat Standard upgrade risks apply - test in non-production environment first if possible

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Metasys System Configuration Tool Scoped from the published advisory
  • Consultation2.0 h
  • Implementation3.0 h
  • Testing2.0 h
  • Review / QA1.0 h
8.0 hours of engineering $1,420
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,272.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2022-21939 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2022-21939 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data