CVE-2023-23584

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence of items that would not otherwise be viewable.

This issue affects: Gallagher Command Centre 8.70 prior to vEL8.70.1787 (MR2), 8.60 prior to vEL8.60.2039 (MR4), all version of 8.50 and prior.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-204CWE-203

Affected software

No affected versions have been published.

Timeline

Published
Dec 18, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-235857.5Experion server DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operationCVE-2023-235865.5Due to a vulnerability in the io_uring subsystem, it is possible to leak kernel memory information to the user process. timens_install callsCVE-2023-235886.3A vulnerability has been identified in SIMATIC IPC1047 (All versions), SIMATIC IPC1047E (All versions with maxView Storage Manager < 4.09.00CVE-2023-235896.5The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protoCVE-2023-23598.8The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload CVE-2023-235907.5Mercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via an unauthenticated CVE-2023-235914.9The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs CVE-2023-235927.5WALLIX Access Manager 3.x through 4.0.x allows a remote attacker to access sensitive information.CVE-2023-235949.8An authentication bypass vulnerability in the web client interface for the CL4NX printer before firmware version 1.13.3-u724_r2 provides remCVE-2023-235957.5BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, sCVE-2023-235968.8jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with CVE-2023-235976.5A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the `fi