CVE-2021-36205 HIGH

CVE-2021-36205: Metasys session token

Vendor Johnson Controls
Product Metasys
Weakness CWE-459
Published April 15, 2022
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Under certain circumstances the session token is not cleared on logout.

Key dates

02Disclosure timeline

April 15, 2022 CVE published
September 16, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-0473 Incomplete Cleanup vulnerability in PMB platform CVE-2023-36468 Upgrading doesn't prevent exploiting vulnerable XWiki documents CVE-2023-42795 Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests CVE-2023-22407 Junos OS and Junos OS Evolved: An RPD crash can happen due to an MPLS TE tunnel configuration change on a directly connected router CVE-2025-66675 Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed