CVE-2023-25074

Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Competencies. This issue affects Command Centre: vEL8.90 prior to vEL8.90.1318 (MR1), vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4), vEL8.60 prior to vEL8.60.2347 (MR6), vEL8.50 prior to vEL8.50.2831 (MR8), all versions vEL8.40 and prior.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-25074	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gallagher:command_centre::::::::
	cpe:2.3:a:gallagher:command_centre::::::::
	cpe:2.3:a:gallagher:command_centre::::::::
	cpe:2.3:a:gallagher:command_centre::::::::
	cpe:2.3:a:gallagher:command_centre::::::::
	cpe:2.3:a:gallagher:command_centre::::::::

History

01 Aug 2023, 19:47

Type	Values Removed	Values Added
First Time		Gallagher command Centre Gallagher
CPE		cpe:2.3:a:gallagher:command_centre::::::::
References	~~(MISC) https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-25074 -~~	(MISC) https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-25074 - Vendor Advisory
CWE		NVD-CWE-Other
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.4

27 Jul 2023, 06:15

Type	Values Removed	Values Added
References	~~{'url': 'https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-25704', 'name': 'https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-25704', 'tags': [], 'refsource': 'MISC'}~~	(MISC) https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-25074 -

25 Jul 2023, 00:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-07-25 00:15

Updated : 2023-12-10 15:14

NVD link : CVE-2023-25074

Mitre link : CVE-2023-25074

CVE.ORG link : CVE-2023-25074

JSON object : View

Products Affected

gallagher

command_centre

CWE

NVD-CWE-Other CWE-285

Improper Authorization

{"id": "CVE-2023-25074", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "disclosures@gallagher.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "published": "2023-07-25T00:15:09.637", "references": [{"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-25074", "tags": ["Vendor Advisory"], "source": "disclosures@gallagher.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "disclosures@gallagher.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "\nImproper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Competencies.\n\n\n\n\n\n\nThis issue affects Command Centre: vEL8.90 prior to vEL8.90.1318 (MR1), vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4), \n\nvEL8.60 prior to vEL8.60.2347 (MR6),\n\nvEL8.50 prior to vEL8.50.2831 (MR8), all versions vEL8.40 and prior.\n\n\n"}], "lastModified": "2023-08-01T19:47:47.580", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E51DC51C-E4D6-4C8D-8235-10258F79A6C5", "versionEndIncluding": "8.40.2216"}, {"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B23146CE-CE9D-4850-8169-D0C168A3D037", "versionEndExcluding": "8.50.2831", "versionStartIncluding": "8.50"}, {"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12131674-A0E9-4A12-BA87-C9207DA8C34C", "versionEndExcluding": "8.60.2347", "versionStartIncluding": "8.60"}, {"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE1E36DB-F15E-449A-A672-4853D31CE064", "versionEndExcluding": "8.70.2185", "versionStartIncluding": "8.70"}, {"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "92A438BA-DC52-4253-B5B6-4BE8CD7A1CCA", "versionEndExcluding": "8.80.1192", "versionStartIncluding": "8.80"}, {"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "110D9A0C-409D-4B1F-84B6-274B15D87CA3", "versionEndExcluding": "8.90.1318", "versionStartIncluding": "8.90"}], "operator": "OR"}]}], "sourceIdentifier": "disclosures@gallagher.com"}