Lucene search

[email protected]CVE-2020-16103

HistoryDec 14, 2020 - 8:15 p.m.

CVE-2020-16103

2020-12-1420:15:12

CWE-843

CWE-704

[email protected]

web.nvd.nist.gov

cve-2020-16103

type confusion

gallagher command centre server

remote code execution

security vulnerability

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.3%

JSON

Type confusion in Gallagher Command Centre Server allows a remote attacker to crash the server or possibly cause remote code execution. This issue affects: Gallagher Command Centre 8.30 versions prior to 8.30.1236(MR1); 8.20 versions prior to 8.20.1166(MR3); 8.10 versions prior to 8.10.1211(MR5); version 8.00 and prior versions.

Affected configurations

NVD

Node

gallaghercommand_centreRange≤8.00

gallaghercommand_centreRange8.10–8.10.1211

gallaghercommand_centreRange8.20–8.20.1166

gallaghercommand_centreRange8.30–8.30.1236

gallaghercommand_centreMatch8.10.1211-

gallaghercommand_centreMatch8.10.1211maintenance_release5

gallaghercommand_centreMatch8.20.1166-

gallaghercommand_centreMatch8.20.1166maintenance_release3

gallaghercommand_centreMatch8.30.1236-

gallaghercommand_centreMatch8.30.1236maintenance_release1

CPENameOperatorVersion
gallagher:command_centregallagher command centrele8.00
gallagher:command_centregallagher command centrelt8.10.1211
gallagher:command_centregallagher command centrelt8.20.1166
gallagher:command_centregallagher command centrelt8.30.1236

CPE	Name	Operator	Version
gallagher:command_centre	gallagher command centre	le	8.00
gallagher:command_centre	gallagher command centre	lt	8.10.1211
gallagher:command_centre	gallagher command centre	lt	8.20.1166
gallagher:command_centre	gallagher command centre	lt	8.30.1236

CNA Affected

[
  {
    "product": "Command Centre",
    "vendor": "Gallagher",
    "versions": [
      {
        "lessThanOrEqual": "8.00",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "8.30.1236(MR1)",
        "status": "affected",
        "version": "8.30",
        "versionType": "custom"
      },
      {
        "lessThan": "8.20.1166(MR3)",
        "status": "affected",
        "version": "8.20",
        "versionType": "custom"
      },
      {
        "lessThan": "8.10.1211(MR5)",
        "status": "affected",
        "version": "8.10",
        "versionType": "custom"
      }
    ]
  }
]

References

security.gallagher.com/Security-Advisories/CVE-2020-16103

Social References

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.3%

JSON

Related for CVE-2020-16103

prion1 cvelist1 nvd1