mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-28 09:11:28 +00:00
405 lines
11 KiB
JSON
405 lines
11 KiB
JSON
{
|
|
"id": "CVE-2023-4486",
|
|
"sourceIdentifier": "productsecurity@jci.com",
|
|
"published": "2023-12-07T20:15:38.530",
|
|
"lastModified": "2024-11-21T08:35:15.983",
|
|
"vulnStatus": "Modified",
|
|
"cveTags": [],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Under certain circumstances, invalid authentication credentials could be sent to the login endpoint of Johnson Controls Metasys NAE55, SNE, and SNC engines prior to \n\nversions 11.0.6 and 12.0.4\n\n and Facility Explorer F4-SNC engines prior to versions 11.0.6 and 12.0.4 to cause denial-of-service.\n\n"
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "En determinadas circunstancias, se podr\u00edan enviar credenciales de autenticaci\u00f3n no v\u00e1lidas al endpoint de inicio de sesi\u00f3n de los motores Johnson Controls Metasys NAE55, SNE y SNC anteriores a la versi\u00f3n 12.0.4 y a los motores Facility Explorer F4-SNC anteriores a las versiones 11.0.6 y 12.0.4 para causar negaci\u00f3n de servicio."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "productsecurity@jci.com",
|
|
"type": "Secondary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"baseScore": 7.5,
|
|
"baseSeverity": "HIGH",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "NONE",
|
|
"integrityImpact": "NONE",
|
|
"availabilityImpact": "HIGH"
|
|
},
|
|
"exploitabilityScore": 3.9,
|
|
"impactScore": 3.6
|
|
},
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"baseScore": 7.5,
|
|
"baseSeverity": "HIGH",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "NONE",
|
|
"integrityImpact": "NONE",
|
|
"availabilityImpact": "HIGH"
|
|
},
|
|
"exploitabilityScore": 3.9,
|
|
"impactScore": 3.6
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "productsecurity@jci.com",
|
|
"type": "Secondary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-400"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-770"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"configurations": [
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:johnsoncontrols:nae55_firmware:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding": "12.0.4",
|
|
"matchCriteriaId": "318A4239-1481-428C-B016-06E90553EA54"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:johnsoncontrols:nae55:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "019B3C3A-BB07-4BC2-B3DB-1C0DEA374251"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:johnsoncontrols:sne22000_firmware:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding": "12.0.4",
|
|
"matchCriteriaId": "7FDD5E06-7317-43C5-8AF7-BA93493BE3ED"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:johnsoncontrols:sne22000:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "62172D94-FE04-421D-82CE-591478DCFCE3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:johnsoncontrols:sne11000_firmware:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding": "12.0.4",
|
|
"matchCriteriaId": "1C20F153-371B-4D79-A792-DA6283339C9E"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:johnsoncontrols:sne11000:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "E057F276-8A92-4686-8A8F-ECB21B7CF684"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:johnsoncontrols:sne10500_firmware:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding": "12.0.4",
|
|
"matchCriteriaId": "4E7BA2B1-EF29-4E71-B57D-5201590E67B4"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:johnsoncontrols:sne10500:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "F50590BF-749B-4C98-831B-FD136C37D947"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:johnsoncontrols:sne110l0_firmware:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding": "12.0.4",
|
|
"matchCriteriaId": "C1EA003B-2FA9-4F13-ADCF-B1259385F2FA"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:johnsoncontrols:sne110l0:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "EBA6E1AC-53C1-45CC-803D-13E18D479CC8"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:johnsoncontrols:snc25150-0_firmware:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding": "12.0.4",
|
|
"matchCriteriaId": "47C1BE3E-D364-46C4-B297-EA0A5446656B"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:johnsoncontrols:snc25150-0:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "24AF3CDD-A0BE-41A6-9A82-2DE7D0FCD246"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:johnsoncontrols:snc25150-04_firmware:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding": "12.0.4",
|
|
"matchCriteriaId": "24406024-FDF7-4C97-88A1-67A376E54BFD"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:johnsoncontrols:snc25150-04:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "91D059DE-095D-4243-B101-16913E68E461"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:johnsoncontrols:snc16120-0_firmware:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding": "12.0.4",
|
|
"matchCriteriaId": "22431067-9203-4CCD-A6E7-A89A7B576A51"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:johnsoncontrols:snc16120-0:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "4D330345-BE9B-409C-BAA6-EB72A5CE9430"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:johnsoncontrols:snc16120-04_firmware:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding": "12.0.4",
|
|
"matchCriteriaId": "321A5153-048F-4328-89CB-D7E57C72C914"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:johnsoncontrols:snc16120-04:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "73B490CE-EE4B-48B7-AD7D-2EFF95D0F45F"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:johnsoncontrols:f4-snc_firmware:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding": "11.0.6",
|
|
"matchCriteriaId": "A49D88F1-20F3-4F73-A3AC-0E5701005F8D"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:johnsoncontrols:f4-snc_firmware:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "12.0.0",
|
|
"versionEndExcluding": "12.0.4",
|
|
"matchCriteriaId": "DD9211CC-D01B-4E01-8813-996F7C3A59AC"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:johnsoncontrols:f4-snc:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "281D5513-A663-48DE-98D8-240C1FC767B5"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-341-03",
|
|
"source": "productsecurity@jci.com",
|
|
"tags": [
|
|
"Third Party Advisory",
|
|
"US Government Resource"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories",
|
|
"source": "productsecurity@jci.com",
|
|
"tags": [
|
|
"Vendor Advisory"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-341-03",
|
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
|
"tags": [
|
|
"Third Party Advisory",
|
|
"US Government Resource"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories",
|
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
|
"tags": [
|
|
"Vendor Advisory"
|
|
]
|
|
}
|
|
]
|
|
} |