CVE-2023-25074 - CVE House
Back to Database
Status published High CVE-2023-25074

Competency access levels not enforced in the server

Vulnerability Description

Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Competencies. This issue affects Command Centre: vEL8.90 prior to vEL8.90.1318 (MR1), vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4), vEL8.60 prior to vEL8.60.2347 (MR6), vEL8.50 prior to vEL8.50.2831 (MR8), all versions vEL8.40 and prior.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-25074

Credits & Attribution

No credits recorded in the NVD database.

References

More from Gallagher

View All →
CVE-2025-64734
Missing Release of Resource after Effective Lifetime (CWE-772) in the...
Low 2.4
CVE-2025-52578
Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335)...
Medium 5.7
CVE-2025-52457
Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an...
Medium 5.7
CVE-2025-48430
Uncaught Exception (CWE-248) in the Command Centre Server allows an...
Medium 5.5
CVE-2025-48428
Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho...
Medium 6.7

Affected Vendor

Affected Software

Command Centre
Vulnerable Versions:
vEL8.40, vEL8.50, vEL8.60, vEL8.70, vEL8.80, vEL8.90

Timeline

Official Publish: July 24th, 2023
Last Modified: October 17th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Weaknesses (CWE)

CWE-285

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion