OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 may expose sensitive information to an unauthorized user under certain circumstances.
Solution:
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
| Link | Tags |
|---|---|
| https://www.johnsoncontrols.com/cyber-solutions/security-advisories | vendor advisory |
| https://www.cisa.gov/news-events/ics-advisories/icsa-23-138-04 | third party advisory us government resource |