Lucene search

[email protected]CVE-2021-23140

HistoryJun 11, 2021 - 4:15 p.m.

CVE-2021-23140

2021-06-1116:15:12

CWE-285

[email protected]

web.nvd.nist.gov

cve-2021-23140

gallagher command centre

vulnerability

improper authorization

security

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.9%

JSON

Improper Authorization vulnerability in Gallagher Command Centre Server allows command line macros to be modified by an unauthorised Command Centre Operator. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 (MR3); 8.30 versions prior to 8.30.1359 (MR3); 8.20 versions prior to 8.20.1259 (MR5); version 8.10 and prior versions.

Affected configurations

NVD

Node

gallaghercommand_centreRange≤8.10

gallaghercommand_centreRange8.20–8.20.1259

gallaghercommand_centreRange8.30–8.30.1359

gallaghercommand_centreRange8.40–8.40.1888

CPENameOperatorVersion
gallagher:command_centregallagher command centrele8.10
gallagher:command_centregallagher command centrelt8.20.1259
gallagher:command_centregallagher command centrelt8.30.1359
gallagher:command_centregallagher command centrelt8.40.1888

CPE	Name	Operator	Version
gallagher:command_centre	gallagher command centre	le	8.10
gallagher:command_centre	gallagher command centre	lt	8.20.1259
gallagher:command_centre	gallagher command centre	lt	8.30.1359
gallagher:command_centre	gallagher command centre	lt	8.40.1888

CNA Affected

[
  {
    "product": "Command Centre",
    "vendor": "Gallagher",
    "versions": [
      {
        "lessThanOrEqual": "8.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "8.40.1888 (MR3)",
        "status": "affected",
        "version": "8.40",
        "versionType": "custom"
      },
      {
        "lessThan": "8.30.1359 (MR3)",
        "status": "affected",
        "version": "8.30",
        "versionType": "custom"
      },
      {
        "lessThan": "8.20.1259 (MR5)",
        "status": "affected",
        "version": "8.20",
        "versionType": "custom"
      }
    ]
  }
]

References

security.gallagher.com/Security-Advisories/CVE-2021-23140

Social References

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.9%

JSON

Related for CVE-2021-23140

prion1 nvd1 cvelist1