Metasys Extended Application XML Data xml external entity reference

Summaryinfo

A vulnerability classified as critical was found in Metasys Extended Application, Data Server, Open Data Server, Open Application Server, Network Automation Engine, Network Integration Engine, LonWorks Control Server, System Configuration Tool and Smoke Control Network Automation Engine. This issue affects some unknown processing of the component XML Data Handler. Such manipulation leads to xml external entity reference. This vulnerability is listed as CVE-2020-9044. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Metasys Extended Application, Data Server, Open Data Server, Open Application Server, Network Automation Engine, Network Integration Engine, LonWorks Control Server, System Configuration Tool and Smoke Control Network Automation Engine (Application Server Software). It has been rated as critical. Affected by this issue is an unknown function of the component XML Data Handler. The manipulation with an unknown input leads to a xml external entity reference vulnerability. Using CWE to declare the problem leads to CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. Impacted is confidentiality, integrity, and availability. CVE summarizes:

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.

The weakness was presented 03/10/2020 (Website). The advisory is available at us-cert.gov. This vulnerability is handled as CVE-2020-9044 since 02/18/2020. The attack may be launched remotely. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-138387, VDB-151230, VDB-155539 and VDB-155613 for similar entries. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Application Server Software

Vendor

• Metasys

Name

• Data Server
• Extended Application
• LonWorks Control Server
• Network Automation Engine
• Network Integration Engine
• Open Application Server
• Open Data Server
• Smoke Control Network Automation Engine
• System Configuration Tool

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion