description:
An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence of items that would not otherwise be viewable.
This issue affects: Gallagher Command Centre 8.70 prior to vEL8.70.1787 (MR2), 8.60 prior to vEL8.60.2039 (MR4), all version of 8.50 and prior.
problem types: CWE-204: Observable Response Discrepancy
affected:
{
defaultStatus: unaffected
product: Command Centre Server
vendor: Gallagher
versions:
lessThanOrEqual: 8.50, status: affected, version: 0, versionType: custom
lessThan: 8.70.1787 (MR2), status: affected, version: 8.70, versionType: custom
lessThan: 8.60.2039 (MR4), status: affected, version: 8.60, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL