What is the severity of CVE-2024-21838?

The severity of CVE-2024-21838 is classified as a medium risk due to the potential for HTML code injection in emails.

How do I fix CVE-2024-21838?

To fix CVE-2024-21838, upgrade Gallagher Command Centre to version vEL9.00.1774 or later.

Which versions of Gallagher Command Centre are affected by CVE-2024-21838?

CVE-2024-21838 affects Gallagher Command Centre versions prior to vEL9.00.1774, as well as several earlier versions down to 8.60.

What type of vulnerability is CVE-2024-21838?

CVE-2024-21838 is an improper neutralization of special elements in output, specifically related to HTML code injection.

Is there a workaround for CVE-2024-21838 before applying a fix?

There are currently no documented workarounds for CVE-2024-21838 other than upgrading to a fixed version.

Vulnerability/
CVE-2024-21838

medium

6.8

CWE

74 94 79

5/3/2024

10/2/2025

CVE-2024-21838: Code Injection

First published: Tue Mar 05 2024(Updated: )

Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could lead to HTML code injection in emails generated by Command Centre. This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 (MR2), 8.90 prior to vEL8.90.1751 (MR3), 8.80 prior to vEL8.80.1526 (MR4), 8.70 prior to vEL8.70.2526 (MR6), all version of 8.60 and prior.

Credit: disclosures@gallagher.com

Affected Software	Affected Version	How to fix
Gallagher Command Centre	<vEL9.00.1774
Gallagher Command Centre	<vEL8.90.1751
Gallagher Command Centre	<vEL8.80.1526
Gallagher Command Centre	<vEL8.70.2526
Gallagher Command Centre	<8.60
Gallagher Command Centre	<=8.60
Gallagher Command Centre	>=8.70<8.70.2526
Gallagher Command Centre	>=8.80<8.80.1526
Gallagher Command Centre	>=8.90<8.90.1751
Gallagher Command Centre	>=9.00<9.00.1774

Never miss a vulnerability like this again

Reference Links

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-21838

Frequently Asked Questions

What is the severity of CVE-2024-21838?
The severity of CVE-2024-21838 is classified as a medium risk due to the potential for HTML code injection in emails.
How do I fix CVE-2024-21838?
To fix CVE-2024-21838, upgrade Gallagher Command Centre to version vEL9.00.1774 or later.
Which versions of Gallagher Command Centre are affected by CVE-2024-21838?
CVE-2024-21838 affects Gallagher Command Centre versions prior to vEL9.00.1774, as well as several earlier versions down to 8.60.
What type of vulnerability is CVE-2024-21838?
CVE-2024-21838 is an improper neutralization of special elements in output, specifically related to HTML code injection.
Is there a workaround for CVE-2024-21838 before applying a fix?
There are currently no documented workarounds for CVE-2024-21838 other than upgrading to a fixed version.

agent/weakness
agent/references
agent/type
agent/first-publish-date
agent/description
agent/author
agent/severity
agent/event
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/source
agent/guess-ai
agent/software-canonical-lookup
agent/tags
agent/softwarecombine
collector/nvd-api
source/NVD
vendor/gallagher
canonical/gallagher command centre
version/gallagher command centre/8.60
version/gallagher command centre/8.70
version/gallagher command centre/8.80
version/gallagher command centre/8.90
version/gallagher command centre/9.00

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.