Exposure of Sensitive Information in OpenBlue Enterprise Manager Data Collector
CVE-2023-2025

5MEDIUM

Key Information:

Vendor

Johnson Controls

Status
Openblue Enterprise Manager Data Collector
Vendor
CVE Published:
18 May 2023

What is CVE-2023-2025?

OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 may expose sensitive information to an unauthorized user under certain circumstances.

Affected Version(s)

OpenBlue Enterprise Manager Data Collector 0 < 3.2.5.75

References

https://www.johnsoncontrols.com/cyber-solutions/security-...
https://www.cisa.gov/news-events/ics-advisories/icsa-23-1...

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rushank Shetty, Security Researcher at Northwestern Mutual
.