Read the docs
TI-2023-09399 Aliases CVE-2023-23568GHSA-fw77-r95c-6756

Improper authorization in Gallagher Command Centre

Priority LOW 24CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-285.

Summary

Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Personal Data Fields. This issue affects Command Centre: vEL 8.90 prior to vEL8.90.1318 (MR1), vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4), vEL8.60 prior to vEL8.60.2347 (MR6), vEL8.50 prior to vEL8.50.2831 (MR8), all versions vEL8.40 and prior

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00314 24th percentileScored 2026-11-08
Fix Fixed Command Centre (Gallagher): 1318, 1192, 2185 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GallagherCommand CentrevEL8.90 to before 1318; vEL8.80 to before 1192; vEL8.70 to before 2185; vEL8.60 to before 2347; vEL8.50 to before 2831; vEL8.401318, 1192, 2185, 2347, 2831Patch availableCNA
  • Command Centre VendorGallagher Affected vEL8.90 to before 1318; vEL8.80 to before 1192; vEL8.70 to before 2185; vEL8.60 to before 2347; vEL8.50 to before 2831; vEL8.40 Fixed in 1318, 1192, 2185, 2347, 2831 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*up to 8.40.2216; 8.50 to before 8.50.2831; 8.60 to before 8.60.2347; 8.70 to before 8.70.2185; 8.80 to before 8.80.1192; 8.90 to before 8.90.1318VulnerableGallagher
  • cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:* Versions up to 8.40.2216; 8.50 to before 8.50.2831; 8.60 to before 8.60.2347; 8.70 to before 8.70.2185; 8.80 to before 8.80.1192; 8.90 to before 8.90.1318 Vulnerable ·Gallagher

Remediation

  • Fix · CNA Command Centre (Gallagher) Fixed in 1318, 1192, 2185, 2347, 2831

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-23568
  2. 2026-10-03 Alias added: GHSA-fw77-r95c-6756

References

Advisory 1

  • TI-2021-05931 Improper authorization in Gallagher Command Centre CVSS 3.1CRITICAL 9.9
  • TI-2020-12668 Improper authentication in Gallagher Command Centre CVSS 3.1CRITICAL 9.8
  • TI-2020-12666 Improper authorization in Gallagher Command Centre CVSS 3.1CRITICAL 9.9
  • TI-2019-11404 An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2). CVSS 3.0CRITICAL 9.8
  • TI-2021-05986 SQL injection in Gallagher Command Centre CVSS 3.1CRITICAL 9.9
  • TI-2020-12673 Incorrect type conversion in Gallagher Command Centre CVSS 3.1HIGH 8.8
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences