CVE-2020-16101 - Vulnerability Details

Vendors	Products
Gallagher	Command Centre

Link	Providers
https://security.gallagher.com/Security-Advisories/CVE-2020-16101

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Command Centre", "vendor": "Gallagher", "versions": [{"lessThanOrEqual": "7.90", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "8.20.1166 (MR3)", "status": "affected", "version": "8.20", "versionType": "custom"}, {"lessThan": "8.10.1211 (MR5)", "status": "affected", "version": "8.10", "versionType": "custom"}, {"lessThan": "8.00.1228 (MR6)", "status": "affected", "version": "8.00", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service due to an out-of-bounds buffer access. Affected versions are v8.20 prior to v8.20.1166(MR3), v8.10 prior to v8.10.1211(MR5), v8.00 prior to v8.00.1228(MR6), all versions of 7.90 and earlier."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-805", "description": "CWE-805 Buffer Access with Incorrect Length Value", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-09-15T13:25:28", "orgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "shortName": "Gallagher"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://security.gallagher.com/Security-Advisories/CVE-2020-16101"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "disclosures@gallagher.com", "ID": "CVE-2020-16101", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Command Centre", "version": {"version_data": [{"version_affected": "<", "version_name": "8.20", "version_value": "8.20.1166 (MR3)"}, {"version_affected": "<", "version_name": "8.10", "version_value": "8.10.1211 (MR5)"}, {"version_affected": "<", "version_name": "8.00", "version_value": "8.00.1228 (MR6)"}, {"version_affected": "<=", "version_value": "7.90"}]}}]}, "vendor_name": "Gallagher"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service due to an out-of-bounds buffer access. Affected versions are v8.20 prior to v8.20.1166(MR3), v8.10 prior to v8.10.1211(MR5), v8.00 prior to v8.00.1228(MR6), all versions of 7.90 and earlier."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-805 Buffer Access with Incorrect Length Value"}]}]}, "references": {"reference_data": [{"name": "https://security.gallagher.com/Security-Advisories/CVE-2020-16101", "refsource": "MISC", "url": "https://security.gallagher.com/Security-Advisories/CVE-2020-16101"}]}, "source": {"discovery": "INTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T13:37:53.251Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://security.gallagher.com/Security-Advisories/CVE-2020-16101"}]}]}, "cveMetadata": {"assignerOrgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "assignerShortName": "Gallagher", "cveId": "CVE-2020-16101", "datePublished": "2020-09-15T13:25:28", "dateReserved": "2020-07-28T00:00:00", "dateUpdated": "2024-08-04T13:37:53.251Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Command Centre (string)

vendor : Gallagher (string)

versions : [ »

0 : { »

lessThanOrEqual : 7.90 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

1 : { »

lessThan : 8.20.1166 (MR3) (string)

status : affected (string)

version : 8.20 (string)

versionType : custom (string)

}

2 : { »

lessThan : 8.10.1211 (MR5) (string)

status : affected (string)

version : 8.10 (string)

versionType : custom (string)

}

3 : { »

lessThan : 8.00.1228 (MR6) (string)

status : affected (string)

version : 8.00 (string)

versionType : custom (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service due to an out-of-bounds buffer access. Affected versions are v8.20 prior to v8.20.1166(MR3), v8.10 prior to v8.10.1211(MR5), v8.00 prior to v8.00.1228(MR6), all versions of 7.90 and earlier. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-805 (string)

description : CWE-805 Buffer Access with Incorrect Length Value (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2020-09-15T13:25:28 (string)

orgId : 0c426f27-3ee1-4eff-be88-288d5a1822bc (string)

shortName : Gallagher (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://security.gallagher.com/Security-Advisories/CVE-2020-16101 (string)

}

]

source : { »

discovery : INTERNAL (string)

}

x_generator : { »

engine : Vulnogram 0.0.9 (string)

}

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : disclosures@gallagher.com (string)

ID : CVE-2020-16101 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Command Centre (string)

version : { »

version_data : [ »

0 : { »

version_affected : < (string)

version_name : 8.20 (string)

version_value : 8.20.1166 (MR3) (string)

}

1 : { »

version_affected : < (string)

version_name : 8.10 (string)

version_value : 8.10.1211 (MR5) (string)

}

2 : { »

version_affected : < (string)

version_name : 8.00 (string)

version_value : 8.00.1228 (MR6) (string)

}

3 : { »

version_affected : <= (string)

version_value : 7.90 (string)

}

]

}

]

}

vendor_name : Gallagher (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service due to an out-of-bounds buffer access. Affected versions are v8.20 prior to v8.20.1166(MR3), v8.10 prior to v8.10.1211(MR5), v8.00 prior to v8.00.1228(MR6), all versions of 7.90 and earlier. (string)

}

]

}

generator : { »

engine : Vulnogram 0.0.9 (string)

}

impact : { »

cvss : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : CWE-805 Buffer Access with Incorrect Length Value (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://security.gallagher.com/Security-Advisories/CVE-2020-16101 (string)

refsource : MISC (string)

url : https://security.gallagher.com/Security-Advisories/CVE-2020-16101 (string)

}

]

}

source : { »

discovery : INTERNAL (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-04T13:37:53.251Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://security.gallagher.com/Security-Advisories/CVE-2020-16101 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 0c426f27-3ee1-4eff-be88-288d5a1822bc (string)

assignerShortName : Gallagher (string)

cveId : CVE-2020-16101 (string)

datePublished : 2020-09-15T13:25:28 (string)

dateReserved : 2020-07-28T00:00:00 (string)

dateUpdated : 2024-08-04T13:37:53.251Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "matchCriteriaId": "8AF24E0D-FEF8-4814-A689-50869362C70A", "versionEndExcluding": "8.00.1228", "versionStartIncluding": "8.00", "vulnerable": true}, {"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "matchCriteriaId": "55BB8603-0AAE-49A3-B127-374F24C498DE", "versionEndExcluding": "8.10.1211", "versionStartIncluding": "8.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "matchCriteriaId": "DE7DBECA-3C79-4346-AB66-B7538B230FE7", "versionEndExcluding": "8.20.1166", "versionStartIncluding": "8.20", "vulnerable": true}, {"criteria": "cpe:2.3:a:gallagher:command_centre:8.00.1228:-:*:*:*:*:*:*", "matchCriteriaId": "B5A79B43-E943-44E2-B13A-64F955518C8F", "vulnerable": true}, {"criteria": "cpe:2.3:a:gallagher:command_centre:8.10.1211:-:*:*:*:*:*:*", "matchCriteriaId": "E672F2DB-6C4D-4549-977C-F4EDBCC461E3", "vulnerable": true}, {"criteria": "cpe:2.3:a:gallagher:command_centre:8.20.1166:-:*:*:*:*:*:*", "matchCriteriaId": "3DACA47B-78DA-4ED5-A15B-04556FA11865", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service due to an out-of-bounds buffer access. Affected versions are v8.20 prior to v8.20.1166(MR3), v8.10 prior to v8.10.1211(MR5), v8.00 prior to v8.00.1228(MR6), all versions of 7.90 and earlier."}, {"lang": "es", "value": "Es posible que una conexi\u00f3n websocket DCOM remota no autenticada bloquee el servicio Command Center debido a un acceso al b\u00fafer fuera de l\u00edmites.&#xa0;Las versiones afectadas son v8.20 anterior a v8.20.1166(MR3), v8.10 anterior a v8.10.1211(MR5), v8.00 anterior a v8.00.1228(MR6), todas las versiones desde 7.90 y anteriores"}], "id": "CVE-2020-16101", "lastModified": "2024-11-21T05:06:46.757", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "disclosures@gallagher.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-09-15T14:15:14.097", "references": [{"source": "disclosures@gallagher.com", "tags": ["Vendor Advisory"], "url": "https://security.gallagher.com/Security-Advisories/CVE-2020-16101"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://security.gallagher.com/Security-Advisories/CVE-2020-16101"}], "sourceIdentifier": "disclosures@gallagher.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-805"}], "source": "disclosures@gallagher.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 8AF24E0D-FEF8-4814-A689-50869362C70A (string)

versionEndExcluding : 8.00.1228 (string)

versionStartIncluding : 8.00 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 55BB8603-0AAE-49A3-B127-374F24C498DE (string)

versionEndExcluding : 8.10.1211 (string)

versionStartIncluding : 8.10 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:* (string)

matchCriteriaId : DE7DBECA-3C79-4346-AB66-B7538B230FE7 (string)

versionEndExcluding : 8.20.1166 (string)

versionStartIncluding : 8.20 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:gallagher:command_centre:8.00.1228:-:*:*:*:*:*:* (string)

matchCriteriaId : B5A79B43-E943-44E2-B13A-64F955518C8F (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:gallagher:command_centre:8.10.1211:-:*:*:*:*:*:* (string)

matchCriteriaId : E672F2DB-6C4D-4549-977C-F4EDBCC461E3 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:gallagher:command_centre:8.20.1166:-:*:*:*:*:*:* (string)

matchCriteriaId : 3DACA47B-78DA-4ED5-A15B-04556FA11865 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service due to an out-of-bounds buffer access. Affected versions are v8.20 prior to v8.20.1166(MR3), v8.10 prior to v8.10.1211(MR5), v8.00 prior to v8.00.1228(MR6), all versions of 7.90 and earlier. (string)

}

1 : { »

lang : es (string)

value : Es posible que una conexión websocket DCOM remota no autenticada bloquee el servicio Command Center debido a un acceso al búfer fuera de límites. Las versiones afectadas son v8.20 anterior a v8.20.1166(MR3), v8.10 anterior a v8.10.1211(MR5), v8.00 anterior a v8.00.1228(MR6), todas las versiones desde 7.90 y anteriores (string)

}

]

id : CVE-2020-16101 (string)

lastModified : 2024-11-21T05:06:46.757 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : PARTIAL (string)

baseScore : 5 (number)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

vectorString : AV:N/AC:L/Au:N/C:N/I:N/A:P (string)

version : 2.0 (string)

}

exploitabilityScore : 10 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : disclosures@gallagher.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2020-09-15T14:15:14.097 (string)

references : [ »

0 : { »

source : disclosures@gallagher.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://security.gallagher.com/Security-Advisories/CVE-2020-16101 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://security.gallagher.com/Security-Advisories/CVE-2020-16101 (string)

}

]

sourceIdentifier : disclosures@gallagher.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-805 (string)

}

]

source : disclosures@gallagher.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-125 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object