description:
Improper privilege validation in Command Centre Server allows authenticated operators to modify Division lineage.
This issue affects Command Centre: vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4), vEL8.60 prior to vEL8.60.2347 (MR6), vEL8.50 prior to vEL8.50.2831(MR8), vEL8.40 and prior.
problem types: CWE-285 Improper Authorization
affected:
{
vendor: Gallagher
product: Command Centre
versions:
status: affected, version: vEL8.80, lessThan: 1192, versionType: custom
status: affected, version: vEL8.70, lessThan: 2185, versionType: custom
status: affected, version: vEL8.60, lessThan: 2347, versionType: custom
status: affected, version: vEL8.50, lessThan: 2831, versionType: custom
status: affected, version: vEL8.40
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: LOW
baseSeverity: HIGH
baseScore: 7.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
]