All CISA Advisories, EN

Johnson Controls exacqVision Server Web Service

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v4 7.6
  • ATTENTION: Exploitable remotely
  • Vendor: Johnson Controls Inc.
  • Equipment: exacqVision Web Service
  • Vulnerability: Permissive Cross-domain Policy with Untrusted Domains

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to send an unauthorized request or access data from an untrusted domain.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Johnson Controls reports that the following versions of exacqVision Web Service are affected:

  • exacqVision Web Service: 22.12.1.0

3.2 Vulnerability Overview

3.2.1 Permissive Cross-domain Policy with Untrusted Domains CWE-942

Under certain circumstances the exacqVision web service does not provide sufficient protection from untrusted domains.

CVE-2024-32862 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.8 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N).

A CVSS v4 score has also been calculated for CVE-2024-32862 . A base score of 7.6 has been calculated; the CVSS vector string is (CVSS4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N).

3.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing, Commercial Facilities, Government Facilities, Transportation Systems, Energy
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COM

    […]
    Content was cut in order to protect the source.Please visit the source for the rest of the article.

    This article has been indexed from All CISA Advisories

    Read the original article: