CVE-2021-23230: Gallagher Command Centre, инжекция

Описание

Оригинално описание

A SQL Injection vulnerability in the OPCUA interface of Gallagher Command Centre allows a remote unprivileged Command Centre Operator to modify Command Centre databases undetected. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 (MR3); 8.30 versions prior to 8.30.1359 (MR3); 8.20 versions prior to 8.20.1259 (MR5); 8.10 versions prior to 8.10.1284 (MR7); version 8.00 and prior versions.

Засегнати продукти

• Gallagher Command Centre: unspecified до 8.00; 8.40 преди 8.40.1888 (MR3); 8.30 преди 8.30.1359 (MR3); 8.20 преди 8.20.1259 (MR5); 8.10 преди 8.10.1284 (MR7)

Вид слабост

• CWE-89 SQL инжекция

История

Други уязвимости в Gallagher Command Centre

• 3.3CVE-2024-23194
• 5.4CVE-2023-23570
• 4.3CVE-2023-23568
• 6.5CVE-2023-22363
• 7.1CVE-2023-25074

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-23230
• https://nvd.nist.gov/vuln/detail/CVE-2021-23230
• https://security.gallagher.com/Security-Advisories/CVE-2021-23230