PT-2020-10243 · Gallagher · Gallagher Command Centre Server

Published 2020-01-17 · Updated 2021-07-21 · CVE-2019-19802

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gallagher Command Centre Server versions prior to 8.10.1134(MR4) Gallagher Command Centre Server versions prior to 8.00.1161(MR5) Gallagher Command Centre Server versions prior to 7.90.991(MR5) Gallagher Command Centre Server versions prior to 7.80.960(MR2) Gallagher Command Centre Server version 7.70 or earlier

Description An issue exists where an authenticated user connecting to OPCUA can view all data that would be replicated in a multi-server setup without privilege checks being applied.

Recommendations For versions prior to 8.10.1134(MR4), update to version 8.10.1134(MR4) or later. For versions prior to 8.00.1161(MR5), update to version 8.00.1161(MR5) or later. For versions prior to 7.90.991(MR5), update to version 7.90.991(MR5) or later. For versions prior to 7.80.960(MR2), update to version 7.80.960(MR2) or later. For version 7.70 or earlier, update to a version later than 7.70.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2019-19802

Affected Products

Gallagher Command Centre Server

References · 3

• https://security.gallagher.com/cve-2019-19802 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19802 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19802 · Vendor Advisory