CVE-2022-26348
Description
Command Centre Server is vulnerable to SQL Injection via Windows Registry settings for date fields on the server. The Windows Registry setting allows an attacker using the Visitor Management Kiosk, an application designed for public use, to invoke an arbitrary SQL query that has been preloaded into the registry of the Windows Server to obtain sensitive information. This issue affects: Gallagher Command Centre 8.60 versions prior to 8.60.1652; 8.50 versions prior to 8.50.2245; 8.40 versions prior to 8.40.2216; 8.30 versions prior to 8.30.1470; version 8.20 and prior versions.
How to fix
- gallagher command_centre8.30.1470, 8.40.2216, 8.50.2245, 8.60.1652 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gallagher command_centre | v ≤ 8.20, 8.30 ≤ v < 8.30.1470, 8.40 ≤ v < 8.40.2216, 8.50 ≤ v < 8.50.2245, 8.60 ≤ v < 8.60.1652 | 8.30.1470, 8.40.2216, 8.50.2245, 8.60.1652 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.