CVE:CVE-2021-36200
CNNVD:CNNVD-202207-2132
Johnson Controls Metasys ADS/ADX/OAS Servers是美国江森自控（Johnson Controls）公司的一种应用程序和数据服务器。
Johnson Controls Metasys ADS/ADX/OAS 10版本和11版本存在访问控制错误漏洞，该漏洞源于在某些情况下，未经身份验证的用户可以访问Metasys ADS/ADX/OAS Web API并枚举用户。
solution:Upgrade johnsoncontrols metasys_application_and_data_server to a higher version than 10.1.6,11.0.2,and avoid the version [10.0,10.1.6),[11.0,11.0.2); Upgrade johnsoncontrols metasys_extended_application_and_data_server to a higher version than 10.1.6,11.0.2,and avoid the version [10.0,10.1.6),[11.0,11.0.2); Upgrade johnsoncontrols metasys_open_application_server to a higher version than 10.1.6,11.0.2,and avoid the version [10.0,10.1.6),[11.0,11.0.2)