CVE-2022-26348

Severity: High CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Components affected: Command Centre Server
Version of Command Centre affected: 8.30 prior to 8.30.1470 (MR), 8.40 prior to 8.40.2216 (MR), 8.50 prior to 8.50.2245 (MR), 8.60 prior to 8.60.1652 (MR)
Reported by: Gallagher internal
Active exploitation of vulnerability*: No
Description of vulnerability: Command Centre Server is vulnerable to SQL Injection via Windows Registry settings for date fields on the server. The Windows Registry setting allows an attacker using the Visitor Management Kiosk, an application designed for public use, to invoke an arbitrary SQL query that has been preloaded into the registry of the Windows Server to obtain sensitive information. This issue affects: Gallagher Command Centre 8.60 versions prior to vEL8.60.1652 (MR2), 8.50 prior to 8.50.2245 (MR4); 8.40 prior to 8.40.2216 (MR5); 8.30 prior to 8.30.1470 (MR5); version 8.20 and prior versions.
Mitigation: Remove Personal Data Fields of type 'Date' from all Visitor Fields in Visitor Management configuration

Maintenance releases are now available for:

• v8.60 - v8.60.1652 (MR2)

• v8.50 - v8.50.2245 (MR4)

• v8.40 - v8.40.2216 (MR5)

• v8.30 - v8.30.1470 (MR5)

*This indicates whether Gallagher are aware of this being actively exploited against customer sites at the time of publication.