Insecure Log File Insertion (CWE-532) in Gallagher Command Centre Allow Unauthorized Access to Sensitive Information

CVE-2024-42407

Summary

The Gallagher Command Centre features a vulnerability that enables the insertion of sensitive information into log files, a situation recognized as CWE-532. This flaw permits authenticated operators to access security-sensitive data that should remain restricted. It impacts multiple versions of Command Centre Server, creating potential risks for organizations that rely on this system to manage alerts and alarms securely. Proper auditing and secure logging practices are essential to mitigate the risks associated with unauthorized information access.

References