CVE-2021-23136: 
Gallagher Command Centre vulnerability analysis and mitigation

CVE-2021-23136 is an Improper Authorization vulnerability affecting Gallagher Command Centre Server. The vulnerability impacts multiple versions of the software including 8.40 prior to 8.40.1888 (MR3), 8.30 prior to 8.30.1359 (MR3), 8.20 prior to 8.20.1259 (MR5), 8.10 and earlier versions. The vulnerability allows macro overrides to be performed by an unprivileged Command Centre Operator (Gallagher Security).

The vulnerability has been assigned a CVSS v3.1 score indicating Medium severity with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. This indicates that the vulnerability is network accessible, requires low attack complexity, requires low privileges, needs no user interaction, has no confidentiality impact but high integrity impact, and no availability impact (Gallagher Security).

The vulnerability allows unauthorized macro overrides by unprivileged Command Centre Operators, potentially compromising the integrity of system operations. However, sites not using macros are not impacted by this vulnerability (Gallagher Security).

According to Gallagher Security, there was no active exploitation of this vulnerability reported at the time of disclosure (Gallagher Security).

Gallagher has released maintenance updates to address this vulnerability. The fixed versions are: v8.40.1888(MR3), v8.30.1359(MR3), and v8.20.1259(MR5). These maintenance upgrades require the Command Centre server to be upgraded. For systems not using macros, no immediate action is required as they are not impacted (Gallagher Security).