CVE-2024-21838

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-21838
Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could lead to HTML code injection in emails generated by Command Centre. This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 (MR2), 8.90 prior to vEL8.90.1751 (MR3), 8.80 prior to vEL8.80.1526 (MR4), 8.70 prior to vEL8.70.2526 (MR6),  all version of 8.60 and prior.

6.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-21838 Vendor Advisory
https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-21838 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*
cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*
cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*
cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*
cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*
History

10 Feb 2025, 22:33

Type Values Removed Values Added
CPE cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*
CWE CWE-79
References () https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-21838 - () https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-21838 - Vendor Advisory
First Time Gallagher command Centre
Gallagher

21 Nov 2024, 08:55

Type Values Removed Values Added
References () https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-21838 - () https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-21838 -
Summary
  • (es) La neutralización inadecuada de elementos especiales en la salida (CWE-74) utilizados por la función de generación de correo electrónico de Command Centre Server podría provocar la inyección de código HTML en los correos electrónicos generados por Command Center. Este problema afecta a: Gallagher Command Center 9.00 anterior a vEL9.00.1774 (MR2), 8.90 anterior a vEL8.90.1751 (MR3), 8.80 anterior a vEL8.80.1526 (MR4), 8.70 anterior a vEL8.70.2526 (MR6), todas las versiones de 8.60 y anteriores.

05 Mar 2024, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-05 03:15

Updated : 2025-02-10 22:33

NVD link : CVE-2024-21838

Mitre link : CVE-2024-21838

CVE.ORG link : CVE-2024-21838

JSON object : View

Products Affected

gallagher

  • command_centre
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')