description:
Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users.
This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 (MR2), 8.90 prior to vEL8.90.1751 (MR3), 8.80 prior to vEL8.80.1526 (MR4), 8.70 prior to vEL8.70.2526 (MR6),  all version of 8.60 and prior.
problem types: CWE-522 Insufficiently Protected Credentials
affected:
{
defaultStatus: unaffected
product: Command Centre Server
vendor: Gallagher
versions:
lessThanOrEqual: 8.60, status: affected, version: 0, versionType: custom
lessThan: vEL9.00.1774 (MR2), status: affected, version: 9.00, versionType: custom
lessThan: vEL8.90.1751 (MR3), status: affected, version: 8.90, versionType: custom
lessThan: vEL8.80.1526 (MR4), status: affected, version: 8.80, versionType: custom
lessThan: vEL8.70.2526 (MR6), status: affected, version: 8.70, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL