CVE-2022-21939

Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.

Scoring

Severity

HIGH

CVSS base score

7.5

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS probability

0.16%

CWE

CWE-1004

Published

2023-02-09

Last modified

2026-03-13

Affected products

• Johnson Controls System Configuration Tool (SCT)
• Johnson Controls System Configuration Tool (SCT)

Weakness type

• CWE-1004

Related vulnerabilities

• CVE-2026-22081 — Cookie without HTTPOnly Flag Vulnerability in Tenda Wireless Routers
• CVE-2025-53757 — Insecure Cookie Flags Vulnerability in Digisol DG-GR6821AC Router
• CVE-2025-0479 — Security Misconfiguration Vulnerability in CP Plus Router
• CVE-2021-42115 — Missing HTTPOnly flag on sensitive cookie in TopEase
• CVE-2026-25136 — Rucio WebUI has a Reflected Cross-site Scripting Vulnerability
• CVE-2022-25172 — An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRo
• CVE-2021-3706 — Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte
• CVE-2026-25733 — Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function

Markdown version · Browse all CVEs