Vulnerability Description: Missing Authentication for Critical Function - CWE-306
Software Version: Johnson Controls Metasys MREWeb Service 9.0.0.4256
NIST: https://nvd.nist.gov/vuln/detail/CVE-2021-36200
CVSv3: 5.3
Severity: Medium
Credits: Alessandro Bosco, Luca Di Giuseppe, Stefano Scipioni, Massimiliano Brolli
Under certain circumstances an unauthenticated user could access the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.2 and enumerate users.