Improper Neutralization of Input During Web Page Generation (CWE-79) in Controllers
CVE-2024-23906

6.1MEDIUM

Key Information:

Vendor
Gallagher
Status
Controller 6000 And Controller 7000
Vendor
CVE Published:
11 September 2024

Summary

Improper Neutralization of Input During Web Page Generation (CWE-79) in the Controller 6000 and Controller 7000 diagnostic webpage allows an attacker to modify Controller configuration during an authenticated Operator's session.

This issue affects: Controller 6000 and Controller 7000 9.10 prior to vCR9.10.240816a (distributed in 9.10.1530 (MR2)), 9.00 prior to vCR9.00.240816a (distributed in 9.00.2168 (MR4)), 8.90 prior to vCR8.90.240816a (distributed in 8.90.2155 (MR5)), 8.80 prior to vCR8.80.240816b (distributed in 8.80.1938 (MR6)), all versions of 8.70 and prior.

Affected Version(s)

Controller 6000 and Controller 7000 0 <= 8.70

Controller 6000 and Controller 7000 0 <= 8.70

Controller 6000 and Controller 7000 9.10

References

https://security.gallagher.com/en-NZ/Security-Advisories/...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.