CVE-2020-16104

HIGH

7.2

CVSS Score

Published: December 14, 2020 at 07:23 PM UTC

Updated: June 17, 2026 at 02:57 AM UTC

1 product affected across 1 vendorCommand Centre

Using Command Centre by Gallagher?

Get instant alerts when new vulnerabilities affect Command Centre - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.2

Exploit prediction

EPSS 0.9%

Description

SQL Injection vulnerability in Enterprise Data Interface of Gallagher Command Centre allows a remote attacker with 'Edit Enterprise Data Interfaces' privilege to execute arbitrary SQL against a third party database if EDI is configured to import data from this database. This issue affects: Gallagher Command Centre 8.30 versions prior to 8.30.1236(MR1); 8.20 versions prior to 8.20.1166(MR3); 8.10 versions prior to 8.10.1211(MR5); 8.00 versions prior to 8.00.1228(MR6); version 7.90 and prior versions.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Command Centre · Gallagher

95%

v ≤ 7.90v < 7.90.08.00 ≤ v < 8.00.12288.00 ≤ v < 8.00.1228(MR6)8.10 ≤ v < 8.10.12118.10 ≤ v < 8.10.1211(MR5)8.20 ≤ v < 8.20.11668.20 ≤ v < 8.20.1166(MR3)8.30 ≤ v < 8.30.12368.30 ≤ v < 8.30.1236(MR1)8.00 8.00.1228 8.00.1228 maintenance_release6 8.10 8.10.1211 8.10.1211 maintenance_release5 8.20 8.20.1166 8.20.1166 maintenance_release3 8.30 8.30.1236 8.30.1236 maintenance_release1

Affected range stops below 7.90.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.00.1228, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.00.1228(MR6), so it looks safe — our inference, not a vendor statement

Affected range stops below 8.10.1211, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.10.1211(MR5), so it looks safe — our inference, not a vendor statement

Affected range stops below 8.20.1166, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.20.1166(MR3), so it looks safe — our inference, not a vendor statement

Affected range stops below 8.30.1236, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.30.1236(MR1), so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://security.gallagher.com/Security-Advisories/CVE-2020-16104

References (1)

x_refsource_MISCVendor Advisory

Source: [email protected]

https://security.gallagher.com/Security-Advisories/CVE-2020-16104

CVSS

7.2HIGH[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: HIGH
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-89

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card