CVE-2023-25074

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Competencies.

This issue affects Command Centre: vEL8.90 prior to vEL8.90.1318 (MR1), vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4),

vEL8.60 prior to vEL8.60.2347 (MR6),

vEL8.50 prior to vEL8.50.2831 (MR8), all versions vEL8.40 and prior.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-285

Affected software

Vendor	Product	Versions
Gallagher	Command Centre	vEL8.40; >= vEL8.50, < 2831; >= vEL8.60, < 2347; >= vEL8.70, < 2185; >= vEL8.80, < 1192; >= vEL8.90, < 1318

References

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-25074Vendor Advisory
https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-25074Vendor Advisory

Timeline

Published: Jul 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-250757.8Unquoted search path in the installer for some Intel Server Configuration Utility software before version 16.0.9 may allow an authenticated CVE-2023-250769.8A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master branch (commit: 822bb80d CVE-2023-250775.4Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 CVE-2023-250787.5Server or Console Station DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration CVE-2023-25086.5The `PaperCutNG Mobility Print` version 1.0.3512 application allows an unauthenticated attacker to perform a CSRF attack on an instance ad CVE-2023-250805.5Protection mechanism failure in some Intel(R) Distribution of OpenVINO toolkit software before version 2023.0.0 may allow an authenticated u CVE-2023-250817.2Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat CVE-2023-250827.2Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat CVE-2023-250837.2Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat CVE-2023-250847.2Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat CVE-2023-250857.2Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat CVE-2023-250867.2Multiple buffer overflow vulnerabilities exist in the vtysh_ubus binary of Milesight UR32L v32.3.0.5 due to the use of an unsafe sprintf pat