CVE-2023-22363: 
Gallagher Command Centre vulnerability analysis and mitigation

CVE-2023-22363 is a stack-based buffer overflow vulnerability affecting the Command Centre Server software. The vulnerability was discovered in version 8.80 prior to version 8.80.1192 (MR2). The issue was identified and reported by Gallagher Internal, with no active exploitation reported at the time of disclosure (Vendor Advisory).

The vulnerability is classified as a stack-based buffer overflow (CWE-121) and out-of-bounds write (CWE-787) issue. It received a CVSS v3.1 base score of 7.5 (HIGH) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, while Gallagher Group Ltd. assessed it with a score of 6.5 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability allows an attacker to cause a denial-of-service attack through the process of assigning cardholders to an Access Group in the Command Centre Server (Vendor Advisory).

The vulnerability has been addressed in maintenance release vEL8.80.1192 (MR2). No alternative mitigations were provided by the vendor (Vendor Advisory).