CVE-2023-23576 Business logic in Command Centre Server

What is CVE-2023-23576?

CVE-2023-23576 is a medium-severity vulnerability in Gallagher Command Centre Server, published on 18 Dec 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a network outage when competencies are used in the access decision.

This issue affects: Gallagher Command Centre: 8.90 prior to vEL8.90.1620 (MR2), 8.80 prior to vEL8.80.1369 (MR3), 8.70 prior to vEL8.70.2375 (MR5), 8.60 prior to vEL8.60.2550 (MR7), all versions of 8.50 and prior.

Weakness: CWE-696

Which versions are affected by CVE-2023-23576?

It affects 1 product.

Products include Gallagher Command Centre.

How do I fix CVE-2023-23576?

No fix has been published for CVE-2023-23576 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-23576 being exploited?

There is no known exploitation of CVE-2023-23576 in the wild and no public exploit code.

Other vulnerabilities in Gallagher Command Centre Server

• CVE-2021-23140 Missing authorization in Command Centre Critical 9.9
• CVE-2021-23230 SQL injection in Command Centre Critical 9.9
• CVE-2020-16096 Missing authorization in Command Centre Critical 9.9
• CVE-2020-16098 Information disclosure in Command Centre Critical 9.8
• CVE-2019-15294 Information disclosure in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5gjx-6hg3-323g.