CVE-2023-25074: Competency access levels not enforced in the server
First published: Mon Jul 24 2023(Updated: )
Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Competencies. This issue affects Command Centre: vEL8.90 prior to vEL8.90.1318 (MR1), vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4), vEL8.60 prior to vEL8.60.2347 (MR6), vEL8.50 prior to vEL8.50.2831 (MR8), all versions vEL8.40 and prior.
Credit: disclosures@gallagher.com disclosures@gallagher.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Gallagher Command Centre | <=8.40.2216 | |
| Gallagher Command Centre | >=8.50<8.50.2831 | |
| Gallagher Command Centre | >=8.60<8.60.2347 | |
| Gallagher Command Centre | >=8.70<8.70.2185 | |
| Gallagher Command Centre | >=8.80<8.80.1192 | |
| Gallagher Command Centre | >=8.90<8.90.1318 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-25074?
CVE-2023-25074 is a vulnerability in Command Centre Server that allows authenticated unprivileged operators to modify and view Competencies.
Which versions of Command Centre Server are affected by CVE-2023-25074?
Versions vEL8.90 prior to vEL8.90.1318 (MR1), vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4), vEL8.60 prior to vEL8.60.2347, vEL8.50 prior to vEL8.50.2831, and vEL8.40 prior to vEL8.40.2216 are affected by CVE-2023-25074.
How severe is CVE-2023-25074?
CVE-2023-25074 has a severity rating of 5.4 (Moderate).
How can I fix CVE-2023-25074?
To fix CVE-2023-25074, it is recommended to upgrade to a patched version of Command Centre Server.
Where can I find more information about CVE-2023-25074?
You can find more information about CVE-2023-25074 on the [Gallagher Security Advisories](https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-25074) website.
- collector/nvd-latest
- collector/nvd-index
- agent/author
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/nvd-api
- agent/software-canonical-lookup-request
- agent/references
- agent/description
- agent/severity
- agent/title
- agent/event
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- vendor/gallagher
- canonical/gallagher command centre
- version/gallagher command centre/8.40.2216
- version/gallagher command centre/8.50
- version/gallagher command centre/8.60
- version/gallagher command centre/8.70
- version/gallagher command centre/8.80
- version/gallagher command centre/8.90