PT-2024-19711 · Gallagher · Gallagher Command Centre

Published 2024-07-10 · Updated 2024-07-11 · CVE-2024-23194

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gallagher Command Centre versions 9.10 prior to 9.10.1268 (MR1)

Description The issue is related to improper output neutralization for logs in the Command Centre API Diagnostics Endpoint, which could allow an attacker to modify Command Centre log files. This gives the attacker a limited ability to alter log files.

Recommendations For Gallagher Command Centre versions 9.10 prior to 9.10.1268 (MR1), update to version 9.10.1268 (MR1) or later to resolve the issue. As a temporary workaround, consider restricting access to the Command Centre API Diagnostics Endpoint to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-117

Related Identifiers

CVE-2024-23194

Affected Products

Gallagher Command Centre

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-23194 · Security Note
• https://security.gallagher.com/Security-Advisories/CVE-2024-23194 · Note
• https://twitter.com/CVEnew/status/1811322662826004719 · Twitter Post
• https://t.me/cvenotify/85760 · Telegram Post
• https://t.me/cvedetector/626 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1811274896460165547 · Twitter Post