Lucene search

[email protected]CVE-2019-19802

HistoryJan 17, 2020 - 2:15 a.m.

CVE-2019-19802

2020-01-1702:15:11

CWE-862

[email protected]

web.nvd.nist.gov

cve-2019-19802

gallagher command centre

server

opcua

data privacy

authentication

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.6%

JSON

In Gallagher Command Centre Server v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5), v7.80 prior to v7.80.960(MR2) and v7.70 or earlier, an authenticated user connecting to OPCUA can view all data that would be replicated in a multi-server setup without privilege checks being applied.

Affected configurations

NVD

Node

gallaghercommand_centreRange<7.70

gallaghercommand_centreRange7.80–7.80.960

gallaghercommand_centreRange7.90–7.90.991

gallaghercommand_centreRange8.00–8.00.1161

gallaghercommand_centreRange8.10–8.10.1134

gallaghercommand_centreMatch7.80.960-

gallaghercommand_centreMatch7.90.991-

gallaghercommand_centreMatch8.00.1161-

gallaghercommand_centreMatch8.10.1134-

CPENameOperatorVersion
gallagher:command_centregallagher command centrelt7.70
gallagher:command_centregallagher command centrelt7.80.960
gallagher:command_centregallagher command centrelt7.90.991
gallagher:command_centregallagher command centrelt8.00.1161
gallagher:command_centregallagher command centrelt8.10.1134

CPE	Name	Operator	Version
gallagher:command_centre	gallagher command centre	lt	7.70
gallagher:command_centre	gallagher command centre	lt	7.80.960
gallagher:command_centre	gallagher command centre	lt	7.90.991
gallagher:command_centre	gallagher command centre	lt	8.00.1161
gallagher:command_centre	gallagher command centre	lt	8.10.1134

References

security.gallagher.com/cve-2019-19802

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.6%

JSON

Related for CVE-2019-19802

nvd1 prion1 cvelist1