CVE-2024-23194 - OpenCVE

Improper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint could allow an attacker limited ability to modify Command Centre log files. This issue affects: Gallagher Command Centre v9.10 prior to vEL9.10.1268 (MR1).

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://security.gallagher.com/Security-Advisories/CVE-2024-23194

History

No history.

MITRE

Status: PUBLISHED

Assigner: Gallagher

Published: 2024-07-11T02:39:08.929Z

Updated: 2024-08-01T22:59:31.449Z

Reserved: 2024-02-05T04:16:48.025Z

Link: CVE-2024-23194

Vulnrichment

Updated: 2024-08-01T22:59:31.449Z

NVD

Status : Awaiting Analysis

Published: 2024-07-11T03:15:02.903

Modified: 2024-07-11T13:05:54.930

Link: CVE-2024-23194

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-23194", "assignerOrgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "state": "PUBLISHED", "assignerShortName": "Gallagher", "dateReserved": "2024-02-05T04:16:48.025Z", "datePublished": "2024-07-11T02:39:08.929Z", "dateUpdated": "2024-08-01T22:59:31.449Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Command Centre", "vendor": "Gallagher", "versions": [{"lessThan": "vEL9.10.1268", "status": "affected", "version": "9.10", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Improper output Neutralization for Logs (CWE-117) in the Command Centre </span><span style=\"background-color: rgb(255, 255, 255);\">API</span><span style=\"background-color: rgb(255, 255, 255);\"> </span><span style=\"background-color: rgb(255, 255, 255);\">Diagnostics </span><span style=\"background-color: rgb(255, 255, 255);\">Endpoint could allow an attacker limited ability to modify Command Centre log files. </span><br><br><b>This issue affects:</b><span style=\"background-color: rgb(255, 255, 255);\"> Gallagher Command Centre v</span><span style=\"background-color: rgb(255, 255, 255);\">9.10 prior to </span><span style=\"background-color: rgb(255, 255, 255);\">vEL9.10.1268 (MR1).</span><p></p>"}], "value": "Improper output Neutralization for Logs (CWE-117) in the Command Centre API\u00a0Diagnostics Endpoint could allow an attacker limited ability to modify Command Centre log files. \n\nThis issue affects:\u00a0Gallagher Command Centre v9.10 prior to vEL9.10.1268 (MR1)."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-117", "description": "CWE-117 Improper Output Neutralization for Logs", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "shortName": "Gallagher", "dateUpdated": "2024-07-11T02:39:08.929Z"}, "references": [{"url": "https://security.gallagher.com/Security-Advisories/CVE-2024-23194"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-11T20:03:55.374612Z", "id": "CVE-2024-23194", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-12T16:55:36.808Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:59:31.449Z"}, "title": "CVE Program Container", "references": [{"url": "https://security.gallagher.com/Security-Advisories/CVE-2024-23194", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.gallagher.com/Security-Advisories/CVE-2024-23194", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:59:31.449Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-23194", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-11T20:03:55.374612Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-11T20:03:59.580Z"}}], "cna": {"source": {"discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Gallagher", "product": "Command Centre", "versions": [{"status": "affected", "version": "9.10", "lessThan": "vEL9.10.1268", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://security.gallagher.com/Security-Advisories/CVE-2024-23194"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper output Neutralization for Logs (CWE-117) in the Command Centre API\u00a0Diagnostics Endpoint could allow an attacker limited ability to modify Command Centre log files. \n\nThis issue affects:\u00a0Gallagher Command Centre v9.10 prior to vEL9.10.1268 (MR1).", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Improper output Neutralization for Logs (CWE-117) in the Command Centre </span><span style=\"background-color: rgb(255, 255, 255);\">API</span><span style=\"background-color: rgb(255, 255, 255);\"> </span><span style=\"background-color: rgb(255, 255, 255);\">Diagnostics </span><span style=\"background-color: rgb(255, 255, 255);\">Endpoint could allow an attacker limited ability to modify Command Centre log files. </span><br><br><b>This issue affects:</b><span style=\"background-color: rgb(255, 255, 255);\"> Gallagher Command Centre v</span><span style=\"background-color: rgb(255, 255, 255);\">9.10 prior to </span><span style=\"background-color: rgb(255, 255, 255);\">vEL9.10.1268 (MR1).</span><p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-117", "description": "CWE-117 Improper Output Neutralization for Logs"}]}], "providerMetadata": {"orgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "shortName": "Gallagher", "dateUpdated": "2024-07-11T02:39:08.929Z"}}}, "cveMetadata": {"cveId": "CVE-2024-23194", "state": "PUBLISHED", "dateUpdated": "2024-08-01T22:59:31.449Z", "dateReserved": "2024-02-05T04:16:48.025Z", "assignerOrgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "datePublished": "2024-07-11T02:39:08.929Z", "assignerShortName": "Gallagher"}, "dataVersion": "5.1"}