PT-2022-17802 · Microsoft+1 · Windows Server+1

Published 2022-07-06 · Updated 2022-07-14 · CVE-2022-26348

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gallagher Command Centre versions prior to 8.60.1652 Gallagher Command Centre versions prior to 8.50.2245 Gallagher Command Centre versions prior to 8.40.2216 Gallagher Command Centre versions prior to 8.30.1470 Gallagher Command Centre version 8.20 and prior versions

Description The issue is related to SQL Injection via Windows Registry settings for date fields on the server. An attacker using the Visitor Management Kiosk can invoke an arbitrary SQL query that has been preloaded into the registry of the Windows Server to obtain sensitive information.

Recommendations For versions prior to 8.60.1652, update to version 8.60.1652 or later. For versions prior to 8.50.2245, update to version 8.50.2245 or later. For versions prior to 8.40.2216, update to version 8.40.2216 or later. For versions prior to 8.30.1470, update to version 8.30.1470 or later. For version 8.20 and prior versions, update to a version later than 8.20.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-26348

Affected Products

Gallagher Command Centre

Windows Server

References · 4

• https://osv.dev/vulnerability/CVE-2022-26348 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26348 · Security Note
• https://security.gallagher.com/Security-Advisories/CVE-2022-26348 · Vendor Advisory
• https://t.me/cibsecurity/45681 · Telegram Post