What’s Vulnerable › Vulnerabilities

CVE-2022-21940: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT)

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-02-09 · updated 2026-06-17
• Weakness: CWE-614

Description

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

Affected products

• Johnson Controls System Configuration Tool (SCT): from 14.0 before 14.2.3; from 15.0 before 15.0.3 — fixed in 14.2.3, 15.0.3

How to fix

Upgrade to a fixed version: Johnson Controls System Configuration Tool (SCT) 14.2.3, 15.0.3. Check the vendor advisory for mitigations.

References

• https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03
• https://www.johnsoncontrols.com/cyber-solutions/security-advisories
• https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-03
• https://www.johnsoncontrols.com/cyber-solutions/security-advisories

Get alerted when CVE-2022-21940 or the next vulnerability affects your stack