CVE-2024-43690
High
Description
Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Execution (RCE). This issue affects: Command Centre Server and Command Centre Workstations 9.10 prior to vEL9.10.1530 (MR2), 9.00 prior to vEL9.00.2168 (MR4), 8.90 prior to vEL8.90.2155 (MR5), 8.80 prior to vEL8.80.1938 (MR6), all versions of 8.70 and prior.
SeverityHigh
CVSS8.0
Exploit probability49. percentile0.6%
ProductCommand Centre Server
PublishedSep 11, 2024
First seenSep 11, 2024
Weakness typeCWE-829CWE-829
How to fix
Update
- Gallagher Command Centre ServervEL9.10.1530(MR2), vEL9.00.2168 (MR4), vEL8.90.2155 (MR5), vEL8.80.1938 (MR6) or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Gallagher Command Centre Server | v ≤ 8.70, 9.10 ≤ v < vEL9.10.1530(MR2), 9.00 ≤ v < vEL9.00.2168 (MR4), 8.90 ≤ v < vEL8.90.2155 (MR5), 8.80 ≤ v < vEL8.80.1938 (MR6) | vEL9.10.1530(MR2), vEL9.00.2168 (MR4), vEL8.90.2155 (MR5), vEL8.80.1938 (MR6) |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.