CVE-2021-23197 Privilege escalation in Command Centre

What is CVE-2021-23197?

CVE-2021-23197 is a medium-severity vulnerability in Gallagher Command Centre, published on 18 Nov 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Unquoted service path vulnerability in the Gallagher Controller Service allows an unprivileged user to execute arbitrary code as the account that runs the Controller Service. This issue affects: Gallagher Command Centre 8.50 versions prior to 8.50.2048 (MR3) ;

Weakness: CWE-428

Which versions are affected by CVE-2021-23197?

It affects 1 product.

Products include Gallagher Command Centre.

How do I fix CVE-2021-23197?

No fix has been published for CVE-2021-23197 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-23197 being exploited?

There is no known exploitation of CVE-2021-23197 in the wild and no public exploit code.

Other vulnerabilities in Gallagher Command Centre

• CVE-2021-23140 Missing authorization in Command Centre Critical 9.9
• CVE-2021-23230 SQL injection in Command Centre Critical 9.9
• CVE-2020-16096 Missing authorization in Command Centre Critical 9.9
• CVE-2020-16098 Information disclosure in Command Centre Critical 9.8
• CVE-2019-15294 Information disclosure in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3mgj-25w6-9vm6.