CVE-2021-23193

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Improper privilege validation vulnerability in COM Interface of Gallagher Command Centre Server allows authenticated unprivileged operators to retrieve sensitive information from the Command Centre Server. This issue affects: Gallagher Command Centre 8.50 versions prior to 8.50.2048 (MR3) ; 8.40 versions prior to 8.40.2063 (MR4); 8.30 versions prior to 8.30.1454 (MR4) ; 8.20 versions prior to 8.20.1291 (MR6); version 8.10 and prior versions.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-269

Affected software

Vendor	Product	Versions
Gallagher	Command Centre	>= unspecified, <= 8.10; >= 8.50, < 8.50.2048 (MR3); >= 8.40, < 8.40.2063 (MR4); >= 8.30, < 8.30.1454 (MR4); >= 8.20, < 8.20.1291 (MR6)

References

https://security.gallagher.com/Security-Advisories/CVE-2021-23193Vendor Advisory
https://security.gallagher.com/Security-Advisories/CVE-2021-23193Vendor Advisory

Timeline

Published: Nov 18, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-231955.3Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 has the option for automated indexing (directory listing) activ CVE-2021-231969.8The web application on Agilia Link+ version 3.0 implements authentication and session management mechanisms exclusively on the client-side a CVE-2021-231977.8Unquoted service path vulnerability in the Gallagher Controller Service allows an unprivileged user to execute arbitrary code as the account CVE-2021-231989.8mySCADA myPRO: Versions 8.20.0 and prior has a feature where the password can be specified, which may allow an attacker to inject arbitrary CVE-2021-23209.1Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Management Console). The supp CVE-2021-232017.5NVIDIA GPU and Tegra hardware contain a vulnerability in an internal microcontroller, which may allow a user with elevated privileges to gen CVE-2021-232037.5Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attack CVE-2021-232046.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gallagher Command Centre Server allows OSDP key material to be e CVE-2021-232058.1Improper Encoding or Escaping in Gallagher Command Centre Server allows a Command Centre Operator to alter the configuration of Controllers CVE-2021-232067.8A flaw was found in htmldoc in v1.9.12 and prior. A stack buffer overflow in parse_table() in ps-pdf.cxx may lead to execute arbitrary code CVE-2021-232075.5An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vi CVE-2021-232094.8Multiple Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) vulnerabilities discovered in AMP for WP – Accelerated Mobile