Medium severity · published Mar 5, 2024
CVE-2024-21838
Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could lead to HTML code injection in emails…
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could lead to HTML code injection in emails generated by Command Centre.
This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 (MR2), 8.90 prior to vEL8.90.1751 (MR3), 8.80 prior to vEL8.80.1526 (MR4), 8.70 prior to vEL8.70.2526 (MR6), all version of 8.60 and prior.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Command Centre Server · Gallagher
through 8.60; 9.00 before vEL9.00.1774 (MR2); 8.90 before vEL8.90.1751 (MR3); 8.80 before vEL8.80.1526 (MR4); 8.70 before vEL8.70.2526 · source: vendor
CC
Command Centre · Gallagher
through 8.60; 8.70 before 8.70.2526; 8.80 before 8.80.1526; 8.90 before 8.90.1751; 9.00 before 9.00.1774 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21838
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21838
Vendor Advisory
https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-21838
More from Command Centre Server
9.9
CVE-2025-47699
Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator with limited site…
8.7
CVE-2024-41724
Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server
8.6
CVE-2026-25193
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitigating Factor: Only…
8.5
CVE-2024-42407
Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security…
8.0
CVE-2024-43690
Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Execution (RCE)