title: Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)
description: Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.
problem types: CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
affected:
{
defaultStatus: unaffected
product: System Configuration Tool (SCT)
vendor: Johnson Controls
versions:
lessThan: 14.2.3, status: affected, version: 14, versionType: custom
lessThan: 15.0.3, status: affected, version: 15, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update SCT version 14 with patch 14.2.3