CVE-2023-22439

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-22439
Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) can be used to perform a Denial of Service of the diagnostic web interface. This issue affects: Gallagher Controller 6000 and 7000 8.90 prior to vCR8.90.231204a (distributed in 8.90.1620 (MR2)), 8.80 prior to vCR8.80.231204a (distributed in 8.80.1369 (MR3)), 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)), 8.60 prior to vCR8.60.231116a (distributed in 8.60.2550 (MR7)), all versions of 8.50 and prior.

3.1 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://security.gallagher.com/Security-Advisories/CVE-2023-22439 Vendor Advisory
https://security.gallagher.com/Security-Advisories/CVE-2023-22439 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:gallagher:controller_6000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:gallagher:controller_6000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:gallagher:controller_6000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:gallagher:controller_6000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:gallagher:controller_6000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:gallagher:controller_6000:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*
cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*
cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*
cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*
cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*
OR cpe:2.3:h:gallagher:controller_6000:-:*:*:*:*:*:*:*
cpe:2.3:h:gallagher:controller_7000:-:*:*:*:*:*:*:*
History

21 Nov 2024, 07:44

Type Values Removed Values Added
References () https://security.gallagher.com/Security-Advisories/CVE-2023-22439 - Vendor Advisory () https://security.gallagher.com/Security-Advisories/CVE-2023-22439 - Vendor Advisory
CVSS v2 : unknown
v3 : 4.3 		v2 : unknown
v3 : 3.1

28 Dec 2023, 18:50

Type Values Removed Values Added
References () https://security.gallagher.com/Security-Advisories/CVE-2023-22439 - () https://security.gallagher.com/Security-Advisories/CVE-2023-22439 - Vendor Advisory
Summary
  • (es) Se puede utilizar una validación de entrada incorrecta de una solicitud HTTP grande en la interfaz web de diagnóstico opcional de Controller 6000 y Controller 7000 (puerto 80) para realizar una denegación de servicio de la interfaz web de diagnóstico. Este problema afecta a: Gallagher Controller 6000 y 7000 8.90 antes de vCR8.90.231204a (distribuido en 8.90.1620 (MR2)), 8.80 antes de vCR8.80.231204a (distribuido en 8.80.1369 (MR3)), 8.70 antes de vCR8. 70.231204a (distribuido en 8.70.2375 (MR5)), 8.60 antes de vCR8.60.231116a (distribuido en 8.60.2550 (MR7)), todas las versiones de 8.50 y anteriores.
CPE cpe:2.3:h:gallagher:controller_6000:-:*:*:*:*:*:*:*
cpe:2.3:h:gallagher:controller_7000:-:*:*:*:*:*:*:*
cpe:2.3:o:gallagher:controller_6000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*
First Time Gallagher
Gallagher controller 7000
Gallagher controller 6000 Firmware
Gallagher command Centre
Gallagher controller 6000
CVSS v2 : unknown
v3 : 3.1 		v2 : unknown
v3 : 4.3

18 Dec 2023, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-18 22:15

Updated : 2024-11-21 07:44

NVD link : CVE-2023-22439

Mitre link : CVE-2023-22439

CVE.ORG link : CVE-2023-22439

JSON object : View

Products Affected

gallagher

  • controller_7000
  • command_centre
  • controller_6000_firmware
  • controller_6000
CWE
CWE-20

Improper Input Validation