CVE-2023-25074 — Competency access levels not enforced in the server

Description (CNA)

Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Competencies. This issue affects Command Centre: vEL8.90 prior to vEL8.90.1318 (MR1), vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4), vEL8.60 prior to vEL8.60.2347 (MR6), vEL8.50 prior to vEL8.50.2831 (MR8), all versions vEL8.40 and prior.

Affected (CNA)

Vendor / product	Versions
Gallagher / Command Centre	affected vEL8.40; affected vEL8.50 before 2831; affected vEL8.60 before 2347; affected vEL8.70 before 2185; affected vEL8.80 before 1192; affected vEL8.90 before 1318

CWE

CWE-285

References

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-25074

ADP enrichment

CVE

No English description supplied.

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-25074

CISA-ADP

No English description supplied.

No references supplied.