CVE:CVE-2022-21937
CNNVD:CNNVD-202206-1455
Johnson Controls Metasys ADS/ADX/OAS Servers是美国江森自控（Johnson Controls）公司的一种应用程序和数据服务器。
Johnson Controls Metasys ADS/ADX/OAS Servers10和11版本存在跨站脚本漏洞，该漏洞源于网页生成期间输入的不当中和，攻击者利用该漏洞可以将恶意代码注入和存储到受影响产品的 Web 界面中。
solution:Upgrade johnsoncontrols metasys_application_and_data_server to a higher version than 10.1.5,11.0,11.0.1,and avoid the version [10.0,10.1.5],11.0,11.0.1; Upgrade johnsoncontrols metasys_extended_application_and_data_server to a higher version than 10.1.5,11.0,11.0.1,and avoid the version [10.0,10.1.5],11.0,11.0.1; Upgrade johnsoncontrols metasys_open_application_server to a higher version than 10.1.5,11.0,11.0.1,and avoid the version [10.0,10.1.5),11.0,11.0.1