CVE-2023-23576 - Vulnerability Details

Vendors	Products
Gallagher	Command Centre

Link	Providers
https://security.gallagher.com/Security-Advisories/CVE-2023-23576

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-23576", "assignerOrgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "state": "PUBLISHED", "assignerShortName": "Gallagher", "dateReserved": "2023-02-03T20:38:05.225Z", "datePublished": "2023-12-18T21:59:38.164Z", "dateUpdated": "2024-08-02T10:35:33.566Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Command Centre Server", "vendor": "Gallagher", "versions": [{"lessThanOrEqual": "8.50", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "8.90.1620 (MR2)", "status": "affected", "version": "8.90", "versionType": "custom"}, {"lessThan": "8.80.1369 (MR3)", "status": "affected", "version": "8.80", "versionType": "custom"}, {"lessThan": "8.70.2375 (MR5)", "status": "affected", "version": "8.70", "versionType": "custom"}, {"lessThan": "8.60.2550 (MR7)", "status": "affected", "version": "8.60", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a network outage when competencies are used in the access decision. <br><br>This issue affects: Gallagher Command Centre: 8.90 prior to vEL8.90.1620 (MR2), 8.80 prior to vEL8.80.1369 (MR3), 8.70 prior to vEL8.70.2375 (MR5), 8.60 prior to vEL8.60.2550 (MR7), all versions of 8.50 and prior.</span>\n\n"}], "value": "\nIncorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a network outage when competencies are used in the access decision. \n\nThis issue affects: Gallagher Command Centre: 8.90 prior to vEL8.90.1620 (MR2), 8.80 prior to vEL8.80.1369 (MR3), 8.70 prior to vEL8.70.2375 (MR5), 8.60 prior to vEL8.60.2550 (MR7), all versions of 8.50 and prior.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-696", "description": "CWE-696: Incorrect Behavior Order", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "shortName": "Gallagher", "dateUpdated": "2023-12-18T21:59:38.164Z"}, "references": [{"url": "https://security.gallagher.com/Security-Advisories/CVE-2023-23576"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:35:33.566Z"}, "title": "CVE Program Container", "references": [{"url": "https://security.gallagher.com/Security-Advisories/CVE-2023-23576", "tags": ["x_transferred"]}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-23576 (string)

assignerOrgId : 0c426f27-3ee1-4eff-be88-288d5a1822bc (string)

state : PUBLISHED (string)

assignerShortName : Gallagher (string)

dateReserved : 2023-02-03T20:38:05.225Z (string)

datePublished : 2023-12-18T21:59:38.164Z (string)

dateUpdated : 2024-08-02T10:35:33.566Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : Command Centre Server (string)

vendor : Gallagher (string)

versions : [ »

0 : { »

lessThanOrEqual : 8.50 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

1 : { »

lessThan : 8.90.1620 (MR2) (string)

status : affected (string)

version : 8.90 (string)

versionType : custom (string)

}

2 : { »

lessThan : 8.80.1369 (MR3) (string)

status : affected (string)

version : 8.80 (string)

versionType : custom (string)

}

3 : { »

lessThan : 8.70.2375 (MR5) (string)

status : affected (string)

version : 8.70 (string)

versionType : custom (string)

}

4 : { »

lessThan : 8.60.2550 (MR7) (string)

status : affected (string)

version : 8.60 (string)

versionType : custom (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : <span style="background-color: rgb(255, 255, 255);">Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a network outage when competencies are used in the access decision. <br><br>This issue affects: Gallagher Command Centre: 8.90 prior to vEL8.90.1620 (MR2), 8.80 prior to vEL8.80.1369 (MR3), 8.70 prior to vEL8.70.2375 (MR5), 8.60 prior to vEL8.60.2550 (MR7), all versions of 8.50 and prior.</span> (string)

}

]

value : Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a network outage when competencies are used in the access decision. This issue affects: Gallagher Command Centre: 8.90 prior to vEL8.90.1620 (MR2), 8.80 prior to vEL8.80.1369 (MR3), 8.70 prior to vEL8.70.2375 (MR5), 8.60 prior to vEL8.60.2550 (MR7), all versions of 8.50 and prior. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : PHYSICAL (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-696 (string)

description : CWE-696: Incorrect Behavior Order (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 0c426f27-3ee1-4eff-be88-288d5a1822bc (string)

shortName : Gallagher (string)

dateUpdated : 2023-12-18T21:59:38.164Z (string)

}

references : [ »

0 : { »

url : https://security.gallagher.com/Security-Advisories/CVE-2023-23576 (string)

}

]

source : { »

discovery : INTERNAL (string)

}

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T10:35:33.566Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://security.gallagher.com/Security-Advisories/CVE-2023-23576 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

]

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "matchCriteriaId": "23C4F969-A44F-40D6-A92B-56A2653A0786", "versionEndIncluding": "8.50", "vulnerable": true}, {"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "matchCriteriaId": "54586395-20DD-4AB8-8C2A-26870B1522A2", "versionEndExcluding": "8.60.2550", "versionStartIncluding": "8.60", "vulnerable": true}, {"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "matchCriteriaId": "1E787E1B-4152-4F45-8E6E-1761938E48A3", "versionEndExcluding": "8.70.2375", "versionStartIncluding": "8.70", "vulnerable": true}, {"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "matchCriteriaId": "6091751E-0326-445F-ABFF-09BE6D3543BF", "versionEndExcluding": "8.80.1369", "versionStartIncluding": "8.80", "vulnerable": true}, {"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "matchCriteriaId": "1B0605C7-4DC1-4F63-9987-D3320AC4D6A5", "versionEndExcluding": "8.90.1620", "versionStartIncluding": "8.90", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "\nIncorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a network outage when competencies are used in the access decision. \n\nThis issue affects: Gallagher Command Centre: 8.90 prior to vEL8.90.1620 (MR2), 8.80 prior to vEL8.80.1369 (MR3), 8.70 prior to vEL8.70.2375 (MR5), 8.60 prior to vEL8.60.2550 (MR7), all versions of 8.50 and prior.\n\n"}, {"lang": "es", "value": "El orden de comportamiento incorrecto en Command Center Server podr\u00eda permitir que los usuarios privilegiados obtengan acceso f\u00edsico al sitio durante m\u00e1s tiempo del previsto despu\u00e9s de una interrupci\u00f3n de la red cuando se utilizan competencias en la decisi\u00f3n de acceso. Este problema afecta a: Gallagher Command Center: 8.90 anterior a vEL8.90.1620 (MR2), 8.80 anterior a vEL8.80.1369 (MR3), 8.70 anterior a vEL8.70.2375 (MR5), 8.60 anterior a vEL8.60.2550 (MR7), todas las versiones de 8.50 y anteriores."}], "id": "CVE-2023-23576", "lastModified": "2024-11-21T07:46:27.683", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 3.6, "source": "disclosures@gallagher.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-12-18T22:15:08.210", "references": [{"source": "disclosures@gallagher.com", "tags": ["Vendor Advisory"], "url": "https://security.gallagher.com/Security-Advisories/CVE-2023-23576"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://security.gallagher.com/Security-Advisories/CVE-2023-23576"}], "sourceIdentifier": "disclosures@gallagher.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-696"}], "source": "disclosures@gallagher.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 23C4F969-A44F-40D6-A92B-56A2653A0786 (string)

versionEndIncluding : 8.50 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 54586395-20DD-4AB8-8C2A-26870B1522A2 (string)

versionEndExcluding : 8.60.2550 (string)

versionStartIncluding : 8.60 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 1E787E1B-4152-4F45-8E6E-1761938E48A3 (string)

versionEndExcluding : 8.70.2375 (string)

versionStartIncluding : 8.70 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 6091751E-0326-445F-ABFF-09BE6D3543BF (string)

versionEndExcluding : 8.80.1369 (string)

versionStartIncluding : 8.80 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 1B0605C7-4DC1-4F63-9987-D3320AC4D6A5 (string)

versionEndExcluding : 8.90.1620 (string)

versionStartIncluding : 8.90 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a network outage when competencies are used in the access decision. This issue affects: Gallagher Command Centre: 8.90 prior to vEL8.90.1620 (MR2), 8.80 prior to vEL8.80.1369 (MR3), 8.70 prior to vEL8.70.2375 (MR5), 8.60 prior to vEL8.60.2550 (MR7), all versions of 8.50 and prior. (string)

}

1 : { »

lang : es (string)

value : El orden de comportamiento incorrecto en Command Center Server podría permitir que los usuarios privilegiados obtengan acceso físico al sitio durante más tiempo del previsto después de una interrupción de la red cuando se utilizan competencias en la decisión de acceso. Este problema afecta a: Gallagher Command Center: 8.90 anterior a vEL8.90.1620 (MR2), 8.80 anterior a vEL8.80.1369 (MR3), 8.70 anterior a vEL8.70.2375 (MR5), 8.60 anterior a vEL8.60.2550 (MR7), todas las versiones de 8.50 y anteriores. (string)

}

]

id : CVE-2023-23576 (string)

lastModified : 2024-11-21T07:46:27.683 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : PHYSICAL (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 0.7 (number)

impactScore : 3.6 (number)

source : disclosures@gallagher.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : PHYSICAL (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 0.7 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-12-18T22:15:08.210 (string)

references : [ »

0 : { »

source : disclosures@gallagher.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://security.gallagher.com/Security-Advisories/CVE-2023-23576 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://security.gallagher.com/Security-Advisories/CVE-2023-23576 (string)

}

]

sourceIdentifier : disclosures@gallagher.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-696 (string)

}

]

source : disclosures@gallagher.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-Other (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Physical

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Affected Vendors & Products

Metrics

Attack Vector Physical

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object