Description

Improper Neutralization of Input During Web Page Generation (CWE-79) in the Controller 6000 and Controller 7000 diagnostic webpage allows an attacker to modify Controller configuration during an authenticated Operator's session. This issue affects: Controller 6000 and Controller 7000 9.10 prior to vCR9.10.240816a (distributed in 9.10.1530 (MR2)), 9.00 prior to vCR9.00.240816a (distributed in 9.00.2168 (MR4)), 8.90 prior to vCR8.90.240816a (distributed in 8.90.2155 (MR5)), 8.80 prior to vCR8.80.240816b (distributed in 8.80.1938 (MR6)), all versions of 8.70 and prior.

INFO

Published Date :

2024-09-11T04:02:29.333Z

Last Modified :

2024-09-11T13:38:21.448Z

Source :

Gallagher
AFFECTED PRODUCTS

The following products are affected by CVE-2024-23906 vulnerability.

Vendors Products
Gallagher
  • Controller 6000
  • Controller 7000
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-23906.

URL Resource
https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-23906 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact