CVE-2023-25074

Competency access levels not enforced in the server

State: Published
Severity: 7.1 High
Published: Jul 24, 2023
Updated: Oct 17, 2024
Reserved: Feb 3, 2023

Description

Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Competencies.

This issue affects Command Centre: vEL8.90 prior to vEL8.90.1318 (MR1), vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4),

vEL8.60 prior to vEL8.60.2347 (MR6),

vEL8.50 prior to vEL8.50.2831 (MR8), all versions vEL8.40 and prior.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L	Gallagher

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
Command CentreGallagher	vEL8.40Affected vEL8.50 to before 2831Affected vEL8.60 to before 2347Affected vEL8.70 to before 2185Affected vEL8.80 to before 1192Affected vEL8.90 to before 1318Affected

References

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-25074

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.