{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-43690", "assignerOrgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "state": "PUBLISHED", "assignerShortName": "Gallagher", "dateReserved": "2024-08-28T02:46:11.119Z", "datePublished": "2024-09-11T04:04:19.129Z", "dateUpdated": "2024-09-11T18:34:36.166Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Command Centre Server", "vendor": "Gallagher", "versions": [{"lessThanOrEqual": "8.70", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "vEL9.10.1530(MR2)", "status": "affected", "version": "9.10", "versionType": "custom"}, {"lessThan": "vEL9.00.2168 (MR4)", "status": "affected", "version": "9.00", "versionType": "custom"}, {"lessThan": "vEL8.90.2155 (MR5)", "status": "affected", "version": "8.90", "versionType": "custom"}, {"lessThan": "vEL8.80.1938 (MR6)", "status": "affected", "version": "8.80", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Execution (RCE).</span>\n\n<p><b>This issue affects:</b> Command Centre Server and Command Centre Workstations&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">9.10 prior to </span><span style=\"background-color: rgb(255, 255, 255);\">vEL9.10.1530 (MR2), </span><span style=\"background-color: rgb(255, 255, 255);\">9.00 prior to </span><span style=\"background-color: rgb(255, 255, 255);\">vEL9.00.2168 (MR4), </span><span style=\"background-color: rgb(255, 255, 255);\">8.90 prior to vEL8.90.2155 (MR5), </span><span style=\"background-color: rgb(255, 255, 255);\">8.80 prior to vEL8.80.1938 (MR6), </span><span style=\"background-color: rgb(255, 255, 255);\">all versions of 8.70 and prior.</span>\n\n</p>"}], "value": "Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Execution (RCE).\n\nThis issue affects: Command Centre Server and Command Centre Workstations\u00a09.10 prior to vEL9.10.1530 (MR2), 9.00 prior to vEL9.00.2168 (MR4), 8.90 prior to vEL8.90.2155 (MR5), 8.80 prior to vEL8.80.1938 (MR6), all versions of 8.70 and prior."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-829", "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "shortName": "Gallagher", "dateUpdated": "2024-09-11T04:04:19.129Z"}, "references": [{"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-43690"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "gallagher", "product": "command_centre", "cpes": ["cpe:2.3:a:gallagher:command_centre:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "8.70", "versionType": "custom"}, {"version": "9.10", "status": "affected", "lessThanOrEqual": "9.10.1530(mr2)", "versionType": "custom"}, {"version": "9.00", "status": "affected", "lessThanOrEqual": "9.00.2168(mr4)", "versionType": "custom"}, {"version": "8.90", "status": "affected", "lessThanOrEqual": "8.90.2155(mr5)", "versionType": "custom"}, {"version": "8.80", "status": "affected", "lessThanOrEqual": "8.80.1938(mr6)", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-11T18:20:31.031982Z", "id": "CVE-2024-43690", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T18:34:36.166Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-43690", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-11T18:20:31.031982Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:gallagher:command_centre:-:*:*:*:*:*:*:*"], "vendor": "gallagher", "product": "command_centre", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.70"}, {"status": "affected", "version": "9.10", "versionType": "custom", "lessThanOrEqual": "9.10.1530(mr2)"}, {"status": "affected", "version": "9.00", "versionType": "custom", "lessThanOrEqual": "9.00.2168(mr4)"}, {"status": "affected", "version": "8.90", "versionType": "custom", "lessThanOrEqual": "8.90.2155(mr5)"}, {"status": "affected", "version": "8.80", "versionType": "custom", "lessThanOrEqual": "8.80.1938(mr6)"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T18:34:31.385Z"}}], "cna": {"source": {"discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Gallagher", "product": "Command Centre Server", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.70"}, {"status": "affected", "version": "9.10", "lessThan": "vEL9.10.1530(MR2)", "versionType": "custom"}, {"status": "affected", "version": "9.00", "lessThan": "vEL9.00.2168 (MR4)", "versionType": "custom"}, {"status": "affected", "version": "8.90", "lessThan": "vEL8.90.2155 (MR5)", "versionType": "custom"}, {"status": "affected", "version": "8.80", "lessThan": "vEL8.80.1938 (MR6)", "versionType": "custom"}], "defaultStatus": "affected"}], "references": [{"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-43690"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Execution (RCE).\n\nThis issue affects: Command Centre Server and Command Centre Workstations\u00a09.10 prior to vEL9.10.1530 (MR2), 9.00 prior to vEL9.00.2168 (MR4), 8.90 prior to vEL8.90.2155 (MR5), 8.80 prior to vEL8.80.1938 (MR6), all versions of 8.70 and prior.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Execution (RCE).</span>\n\n<p><b>This issue affects:</b> Command Centre Server and Command Centre Workstations&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">9.10 prior to </span><span style=\"background-color: rgb(255, 255, 255);\">vEL9.10.1530 (MR2), </span><span style=\"background-color: rgb(255, 255, 255);\">9.00 prior to </span><span style=\"background-color: rgb(255, 255, 255);\">vEL9.00.2168 (MR4), </span><span style=\"background-color: rgb(255, 255, 255);\">8.90 prior to vEL8.90.2155 (MR5), </span><span style=\"background-color: rgb(255, 255, 255);\">8.80 prior to vEL8.80.1938 (MR6), </span><span style=\"background-color: rgb(255, 255, 255);\">all versions of 8.70 and prior.</span>\n\n</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-829", "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere"}]}], "providerMetadata": {"orgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "shortName": "Gallagher", "dateUpdated": "2024-09-11T04:04:19.129Z"}}}, "cveMetadata": {"cveId": "CVE-2024-43690", "state": "PUBLISHED", "dateUpdated": "2024-09-11T18:34:36.166Z", "dateReserved": "2024-08-28T02:46:11.119Z", "assignerOrgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "datePublished": "2024-09-11T04:04:19.129Z", "assignerShortName": "Gallagher"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Execution (RCE).\n\nThis issue affects: Command Centre Server and Command Centre Workstations\u00a09.10 prior to vEL9.10.1530 (MR2), 9.00 prior to vEL9.00.2168 (MR4), 8.90 prior to vEL8.90.2155 (MR5), 8.80 prior to vEL8.80.1938 (MR6), all versions of 8.70 and prior."}, {"lang": "es", "value": "La inclusi\u00f3n de funcionalidad de Untrusted Control Sphere (CWE-829) en el servidor y las estaciones de trabajo del centro de comando puede permitir que un atacante realice una ejecuci\u00f3n remota de c\u00f3digo (RCE). Este problema afecta a: servidor y estaciones de trabajo del centro de comando 9.10 anteriores a vEL9.10.1530 (MR2), 9.00 anteriores a vEL9.00.2168 (MR4), 8.90 anteriores a vEL8.90.2155 (MR5), 8.80 anteriores a vEL8.80.1938 (MR6), todas las versiones de 8.70 y anteriores."}], "id": "CVE-2024-43690", "lastModified": "2024-09-11T16:26:11.920", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 6.0, "source": "disclosures@gallagher.com", "type": "Secondary"}]}, "published": "2024-09-11T05:15:02.843", "references": [{"source": "disclosures@gallagher.com", "url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-43690"}], "sourceIdentifier": "disclosures@gallagher.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-829"}], "source": "disclosures@gallagher.com", "type": "Secondary"}]}

{}