CVE-2023-22428

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-24 · updated 2026-06-17
Weakness: CWE-285

Description

Improper privilege validation in Command Centre Server allows authenticated operators to modify Division lineage. This issue affects Command Centre: vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4), vEL8.60 prior to vEL8.60.2347 (MR6), vEL8.50 prior to vEL8.50.2831(MR8), vEL8.40 and prior.

Affected products

Gallagher Command Centre: through 8.40.2216; from 8.50 before 8.50.2831; from 8.60 before 8.60.2347; from 8.70 before 8.70.2185; from 8.80 before 8.80.1192 — fixed in 8.50.2831, 8.60.2347, 8.70.2185, 8.80.1192

How to fix

Upgrade to a fixed version: Gallagher Command Centre 8.50.2831, 8.60.2347, 8.70.2185, 8.80.1192. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-22428 or the next vulnerability affects your stack