CVE-2024-43107 - Vulnerability Details - OpenCVE

Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g. alarm events) to be sent to the Plugin.
This issue effects Gallagher MIPS Plugin v4.0 prior to v4.0.32, all versions of v3.0 and prior.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00049.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-43107

History

Mon, 10 Mar 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 10 Mar 2025 03:00:00 +0000

Type	Values Removed	Values Added
Description		Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g. alarm events) to be sent to the Plugin. This issue effects Gallagher MIPS Plugin v4.0 prior to v4.0.32, all versions of v3.0 and prior.
Weaknesses		CWE-295
References		https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-43107
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L'}`

MITRE

Status: PUBLISHED

Assigner: Gallagher

Published: 2025-03-10T02:44:03.188Z

Updated: 2025-03-10T17:16:47.074Z

Reserved: 2024-08-28T02:46:11.149Z

Link: CVE-2024-43107

Vulnrichment

Updated: 2025-03-10T17:16:12.530Z

NVD

Status : Received

Published: 2025-03-10T03:15:26.750

Modified: 2025-03-10T03:15:26.750

Link: CVE-2024-43107

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-43107", "assignerOrgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "state": "PUBLISHED", "assignerShortName": "Gallagher", "dateReserved": "2024-08-28T02:46:11.149Z", "datePublished": "2025-03-10T02:44:03.188Z", "dateUpdated": "2025-03-10T17:16:47.074Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Milestone Integration Plugin", "vendor": "Gallagher", "versions": [{"lessThan": "4.0.32", "status": "affected", "version": "4.0", "versionType": "custom"}, {"lessThanOrEqual": "3.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Impact of this vulnerability is limited to</span><span style=\"background-color: rgb(255, 255, 255);\"> sites making use of the Gallagher Milestone Integration Plugin prior to v4.0.32.</span>\n\n<br>"}], "value": "Impact of this vulnerability is limited to\u00a0sites making use of the Gallagher Milestone Integration Plugin prior to v4.0.32."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) </span><span style=\"background-color: rgb(255, 255, 255);\">permits unauthenticated messages (e.g. alarm events) to be sent to the Plugin.<br>This issue effects Gallagher MIPS Plugin <span style=\"background-color: rgb(255, 255, 255);\">v4.0 prior to v4.0.32, </span><span style=\"background-color: rgb(255, 255, 255);\">all versions of v3.0 and prior.</span>\n\n</span><p></p>"}], "value": "Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g. alarm events) to be sent to the Plugin.\nThis issue effects Gallagher MIPS Plugin\u00a0v4.0 prior to v4.0.32, all versions of v3.0 and prior."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "shortName": "Gallagher", "dateUpdated": "2025-03-10T02:44:03.188Z"}, "references": [{"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-43107"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-10T17:13:06.673037Z", "id": "CVE-2024-43107", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T17:16:47.074Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-43107", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-10T17:13:06.673037Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T17:16:12.530Z"}}], "cna": {"source": {"discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Gallagher", "product": "Milestone Integration Plugin", "versions": [{"status": "affected", "version": "4.0", "lessThan": "4.0.32", "versionType": "custom"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.0"}], "defaultStatus": "affected"}], "references": [{"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-43107"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g. alarm events) to be sent to the Plugin.\nThis issue effects Gallagher MIPS Plugin\u00a0v4.0 prior to v4.0.32, all versions of v3.0 and prior.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) </span><span style=\"background-color: rgb(255, 255, 255);\">permits unauthenticated messages (e.g. alarm events) to be sent to the Plugin.<br>This issue effects Gallagher MIPS Plugin <span style=\"background-color: rgb(255, 255, 255);\">v4.0 prior to v4.0.32, </span><span style=\"background-color: rgb(255, 255, 255);\">all versions of v3.0 and prior.</span>\n\n</span><p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation"}]}], "configurations": [{"lang": "en", "value": "Impact of this vulnerability is limited to\u00a0sites making use of the Gallagher Milestone Integration Plugin prior to v4.0.32.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Impact of this vulnerability is limited to</span><span style=\"background-color: rgb(255, 255, 255);\"> sites making use of the Gallagher Milestone Integration Plugin prior to v4.0.32.</span>\n\n<br>", "base64": false}]}], "providerMetadata": {"orgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "shortName": "Gallagher", "dateUpdated": "2025-03-10T02:44:03.188Z"}}}, "cveMetadata": {"cveId": "CVE-2024-43107", "state": "PUBLISHED", "dateUpdated": "2025-03-10T17:16:47.074Z", "dateReserved": "2024-08-28T02:46:11.149Z", "assignerOrgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "datePublished": "2025-03-10T02:44:03.188Z", "assignerShortName": "Gallagher"}, "dataVersion": "5.1"}