{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-06T08:09:40.544","vulnerabilities":[{"cve":{"id":"CVE-2024-21838","sourceIdentifier":"disclosures@gallagher.com","published":"2024-03-05T03:15:06.280","lastModified":"2025-02-10T22:33:35.600","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"\nImproper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could lead to HTML code injection in emails generated by Command Centre. \n\nThis issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 (MR2), 8.90 prior to vEL8.90.1751 (MR3), 8.80 prior to vEL8.80.1526 (MR4), 8.70 prior to vEL8.70.2526 (MR6),  all version of 8.60 and prior.\n\n\n\n"},{"lang":"es","value":"La neutralización inadecuada de elementos especiales en la salida (CWE-74) utilizados por la función de generación de correo electrónico de Command Centre Server podría provocar la inyección de código HTML en los correos electrónicos generados por Command Center. Este problema afecta a: Gallagher Command Center 9.00 anterior a vEL9.00.1774 (MR2), 8.90 anterior a vEL8.90.1751 (MR3), 8.80 anterior a vEL8.80.1526 (MR4), 8.70 anterior a vEL8.70.2526 (MR6), todas las versiones de 8.60 y anteriores."}],"metrics":{"cvssMetricV31":[{"source":"disclosures@gallagher.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}]},"weaknesses":[{"source":"disclosures@gallagher.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*","versionEndIncluding":"8.60","matchCriteriaId":"E6CB4E79-0153-4DB1-BE98-91A39FB06C5A"},{"vulnerable":true,"criteria":"cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*","versionStartIncluding":"8.70","versionEndExcluding":"8.70.2526","matchCriteriaId":"FA675A52-8CC9-4A20-8EB1-7A066FB8E3C0"},{"vulnerable":true,"criteria":"cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*","versionStartIncluding":"8.80","versionEndExcluding":"8.80.1526","matchCriteriaId":"6BCEEB9A-DB54-4FFB-A596-29E7329958F3"},{"vulnerable":true,"criteria":"cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*","versionStartIncluding":"8.90","versionEndExcluding":"8.90.1751","matchCriteriaId":"5770EF66-119E-414B-9188-53D5935D8CFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*","versionStartIncluding":"9.00","versionEndExcluding":"9.00.1774","matchCriteriaId":"AC849EB3-3967-4018-B28E-83C39E99BB6A"}]}]}],"references":[{"url":"https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-21838","source":"disclosures@gallagher.com","tags":["Vendor Advisory"]},{"url":"https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-21838","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}