Lucene search

[email protected]CVE-2020-16102

HistoryDec 14, 2020 - 8:15 p.m.

CVE-2020-16102

2020-12-1420:15:12

CWE-306

CWE-287

[email protected]

web.nvd.nist.gov

cve-2020-16102

improper authentication

gallagher command centre

remote attacker

server crash

vulnerability

nvd

security issue

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

8.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.6%

JSON

Improper Authentication vulnerability in Gallagher Command Centre Server allows an unauthenticated remote attacker to create items with invalid configuration, potentially causing the server to crash and fail to restart. This issue affects: Gallagher Command Centre 8.30 versions prior to 8.30.1299(MR2); 8.20 versions prior to 8.20.1218(MR4); 8.10 versions prior to 8.10.1253(MR6); 8.00 versions prior to 8.00.1252(MR7); version 7.90 and prior versions.

Affected configurations

NVD

Node

gallaghercommand_centreRange<7.90.0

gallaghercommand_centreRange8.00–8.00.1252

gallaghercommand_centreRange8.10–8.10.1253

gallaghercommand_centreRange8.20–8.20.1218

gallaghercommand_centreRange8.30–8.30.1299

gallaghercommand_centreMatch8.00.1252-

gallaghercommand_centreMatch8.00.1252maintenance_release7

gallaghercommand_centreMatch8.10.1253-

gallaghercommand_centreMatch8.10.1253maintenance_release6

gallaghercommand_centreMatch8.20.1218-

gallaghercommand_centreMatch8.20.1218maintenance_release4

gallaghercommand_centreMatch8.30.1299-

gallaghercommand_centreMatch8.30.1299maintenance_release2

CPENameOperatorVersion
gallagher:command_centregallagher command centrelt7.90.0
gallagher:command_centregallagher command centrelt8.00.1252
gallagher:command_centregallagher command centrelt8.10.1253
gallagher:command_centregallagher command centrelt8.20.1218
gallagher:command_centregallagher command centrelt8.30.1299

CPE	Name	Operator	Version
gallagher:command_centre	gallagher command centre	lt	7.90.0
gallagher:command_centre	gallagher command centre	lt	8.00.1252
gallagher:command_centre	gallagher command centre	lt	8.10.1253
gallagher:command_centre	gallagher command centre	lt	8.20.1218
gallagher:command_centre	gallagher command centre	lt	8.30.1299

CNA Affected

[
  {
    "product": "Command Centre",
    "vendor": "Gallagher",
    "versions": [
      {
        "lessThanOrEqual": "7.90",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "8.30.1299(MR2)",
        "status": "affected",
        "version": "8.30",
        "versionType": "custom"
      },
      {
        "lessThan": "8.20.1218(MR4)",
        "status": "affected",
        "version": "8.20",
        "versionType": "custom"
      },
      {
        "lessThan": "8.10.1253(MR6)",
        "status": "affected",
        "version": "8.10",
        "versionType": "custom"
      },
      {
        "lessThan": "8.00.1252(MR7)",
        "status": "affected",
        "version": "8.00",
        "versionType": "custom"
      }
    ]
  }
]

References

security.gallagher.com/Security-Advisories/CVE-2020-16102

Social References

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

8.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.6%

JSON

Related for CVE-2020-16102

prion1 nvd1 cvelist1