CVE-2023-46686

Severity: Medium CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N

Components affected: Command Centre Diagnostics Service

Version of Command Centre affected: Versions prior to v1.3.0 (distributed in 9.00.1507(MR1))

Reported by: Gallagher Internal

Active exploitation of vulnerability*: No

Description of vulnerability: A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Diagnostics Service to use less secure communication protocols.

This issue affects: Gallagher Diagnostics Service prior to v1.3.0 (distributed in 9.00.1507(MR1)).

Mitigation: None

Maintenance releases are now available for:

• v9.00 – v9.00.1507 (MR1)

Important notes:

*This indicates whether Gallagher are aware of this being actively exploited against customer sites at the time of publication.