Cyber Resilience

CVE-2021-36205

High

Published: 15 April 2022

Published
15 April 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0027 51.3th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-36205 is a high-severity Incomplete Cleanup (CWE-459) vulnerability in Johnsoncontrols Metasys Application And Data Server. Its CVSS base score is 8.1 (High).

Operationally, ranked in the top 48.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Under certain circumstances the session token is not cleared on logout.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

johnsoncontrols
metasys application and data server
10.0 — 10.1.5 · 11.0 — 11.0.2
johnsoncontrols
metasys extended application and data server
10.0 — 10.1.5 · 11.0 — 11.0.2
johnsoncontrols
metasys open application server
10.0 — 10.1.5 · 11.0 — 11.0.2

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-459

Mandates complete sanitization during cleanup so that shared resources (memory, caches, buffers) do not retain data across subjects.

addresses: CWE-459

Operational retention schedules mandate complete cleanup of temporary or residual sensitive data after use.

addresses: CWE-459

Termination of the non-persistent artifact guarantees cleanup of temporary state, directly countering incomplete cleanup weaknesses.

addresses: CWE-459

Fail-safe procedures can explicitly require cleanup of temporary state, resources, or privileges on failure to avoid leaving the system in an inconsistent state.

addresses: CWE-459

The explicit delete step when information is no longer needed implements the cleanup that this weakness omits.

addresses: CWE-459

Enforces complete cleanup and sanitization steps during disposal, closing gaps that leave data remnants on retired components.

References