Read the docs
TI-2023-10546 Aliases CVE-2023-25074GHSA-ffff-jpxq-2jg9

Competency access levels not enforced in the server

Priority LOW 31CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Competencies. This issue affects Command Centre: vEL8.90 prior to vEL8.90.1318 (MR1), vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4), vEL8.60 prior to vEL8.60.2347 (MR6), vEL8.50 prior to vEL8.50.2831 (MR8), all versions vEL8.40 and prior.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00314 24th percentileScored 2026-11-07
Fix Fixed Command Centre (Gallagher): 2831, 2347, 2185 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GallagherCommand CentrevEL8.40; vEL8.50 to before 2831; vEL8.60 to before 2347; vEL8.70 to before 2185; vEL8.80 to before 1192; vEL8.90 to before 13182831, 2347, 2185, 1192, 1318Patch availableCNA
  • Command Centre VendorGallagher Affected vEL8.40; vEL8.50 to before 2831; vEL8.60 to before 2347; vEL8.70 to before 2185; vEL8.80 to before 1192; vEL8.90 to before 1318 Fixed in 2831, 2347, 2185, 1192, 1318 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*up to 8.40.2216; 8.50 to before 8.50.2831; 8.60 to before 8.60.2347; 8.70 to before 8.70.2185; 8.80 to before 8.80.1192; 8.90 to before 8.90.1318VulnerableGallagher
  • cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:* Versions up to 8.40.2216; 8.50 to before 8.50.2831; 8.60 to before 8.60.2347; 8.70 to before 8.70.2185; 8.80 to before 8.80.1192; 8.90 to before 8.90.1318 Vulnerable ·Gallagher

Remediation

  • Fix · CNA Command Centre (Gallagher) Fixed in 2831, 2347, 2185, 1192, 1318

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-25074
  2. 2026-10-03 Alias added: GHSA-ffff-jpxq-2jg9

References

Advisory 1

  • TI-2021-05931 Improper authorization in Gallagher Command Centre CVSS 3.1CRITICAL 9.9
  • TI-2020-12668 Improper authentication in Gallagher Command Centre CVSS 3.1CRITICAL 9.8
  • TI-2020-12666 Improper authorization in Gallagher Command Centre CVSS 3.1CRITICAL 9.9
  • TI-2019-11404 An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2). CVSS 3.0CRITICAL 9.8
  • TI-2021-05986 SQL injection in Gallagher Command Centre CVSS 3.1CRITICAL 9.9
  • TI-2020-12673 Incorrect type conversion in Gallagher Command Centre CVSS 3.1HIGH 8.8
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences