CVE-2020-16103 : Type confusion in Gallagher Command Centre Server allows a remote attacker to cr

Type confusion in Gallagher Command Centre Server allows a remote attacker to crash the server or possibly cause remote code execution. This issue affects: Gallagher Command Centre 8.30 versions prior to 8.30.1236(MR1); 8.20 versions prior to 8.20.1166(MR3); 8.10 versions prior to 8.10.1211(MR5); version 8.00 and prior versions.

Published 2020-12-14 20:15:12

Updated 2022-04-25 17:46:00

Source Gallagher Group Ltd.

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2020-16103

Gallagher » Command Centre
Versions from including (>=) 8.10 and before (<) 8.10.1211
cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*
Matching versions
Gallagher » Command Centre
Versions up to, including, (<=) 8.00
cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*
Matching versions
Gallagher » Command Centre
Versions from including (>=) 8.20 and before (<) 8.20.1166
cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*
Matching versions
Gallagher » Command Centre
Versions from including (>=) 8.30 and before (<) 8.30.1236
cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*
Matching versions
Gallagher » Command Centre » Version: 8.10.1211
cpe:2.3:a:gallagher:command_centre:8.10.1211:-:*:*:*:*:*:*
Matching versions
Gallagher » Command Centre » Version: 8.20.1166
cpe:2.3:a:gallagher:command_centre:8.20.1166:-:*:*:*:*:*:*
Matching versions
Gallagher » Command Centre » Version: 8.10.1211 Update Maintenance Release5
cpe:2.3:a:gallagher:command_centre:8.10.1211:maintenance_release5:*:*:*:*:*:*
Matching versions
Gallagher » Command Centre » Version: 8.20.1166 Update Maintenance Release3
cpe:2.3:a:gallagher:command_centre:8.20.1166:maintenance_release3:*:*:*:*:*:*
Matching versions
Gallagher » Command Centre » Version: 8.30.1236
cpe:2.3:a:gallagher:command_centre:8.30.1236:-:*:*:*:*:*:*
Matching versions
Gallagher » Command Centre » Version: 8.30.1236 Update Maintenance Release1
cpe:2.3:a:gallagher:command_centre:8.30.1236:maintenance_release1:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-16103

EPSS FAQ

0.41%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 74 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-16103

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P	8.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	Gallagher Group Ltd.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-16103

CWE-704 Incorrect Type Conversion or Cast

The product does not correctly convert an object, resource, or structure from one type to a different type.

Assigned by: disclosures@gallagher.com (Secondary)
CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-16103

https://security.gallagher.com/Security-Advisories/CVE-2020-16103

Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-16103

Products affected by CVE-2020-16103

Exploit prediction scoring system (EPSS) score for CVE-2020-16103

CVSS scores for CVE-2020-16103

CWE ids for CVE-2020-16103

References for CVE-2020-16103