VA-25-120-01
Vulnerability from csaf_cisa - Published: 2025-04-30 00:00 - Updated: 2025-04-30 00:00Summary
Commvault Web Server unspecified vulnerability
Notes
Legal Notice
All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).
Countries and Areas Deployed
Worldwide
Critical Infrastructure Sectors
Information Technology
Risk Evaluation
According to Commvault: "The Web Server is a component in CommCell environments that provides a RESTful interface to the software where users can perform various tasks using available APIs". A remote, authenticated attacker can exploit an unspecified vulnerability to compromise a Commvault Web Server.
Recommended Practices
Upgrade to one of the fixed versions (11.36.46, 11.32.89, 11.28.141, or 11.20.217) for Windows and Linux platforms.
Company Headquarters Location
United States
{
"document": {
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "en-US",
"notes": [
{
"category": "legal_disclaimer",
"text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
"title": "Legal Notice"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries and Areas Deployed"
},
{
"category": "other",
"text": "Information Technology",
"title": "Critical Infrastructure Sectors"
},
{
"category": "summary",
"text": "According to Commvault: \"The Web Server is a component in CommCell environments that provides a RESTful interface to the software where users can perform various tasks using available APIs\". A remote, authenticated attacker can exploit an unspecified vulnerability to compromise a Commvault Web Server.",
"title": "Risk Evaluation"
},
{
"category": "general",
"text": "Upgrade to one of the fixed versions (11.36.46, 11.32.89, 11.28.141, or 11.20.217) for Windows and Linux platforms.",
"title": "Recommended Practices"
},
{
"category": "other",
"text": "United States",
"title": "Company Headquarters Location"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "https://www.cisa.gov/report",
"issuing_authority": "CISA",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "Vulnerability Advisory VA-25-120-01 CSAF",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-120-01.json"
}
],
"title": "Commvault Web Server unspecified vulnerability",
"tracking": {
"current_release_date": "2025-04-30T00:00:00Z",
"generator": {
"engine": {
"name": "VINCE-NT",
"version": "1.8.0"
}
},
"id": "VA-25-120-01",
"initial_release_date": "2025-04-30T00:00:00Z",
"revision_history": [
{
"date": "2025-04-30T00:00:00Z",
"number": "1.0.0",
"summary": "Initial publication"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e=11.36.0|\u003c11.36.46",
"product": {
"name": "Commvault Web Server \u003e=11.36.0|\u003c11.36.46",
"product_id": "CSAFPID-0001"
}
},
{
"category": "product_version",
"name": "11.36.46",
"product": {
"name": "Commvault Web Server 11.36.46",
"product_id": "CSAFPID-0002"
}
},
{
"category": "product_version_range",
"name": "\u003e=11.32.0|\u003c11.32.89",
"product": {
"name": "Commvault Web Server \u003e=11.32.0|\u003c11.32.89",
"product_id": "CSAFPID-0003"
}
},
{
"category": "product_version",
"name": "11.32.89",
"product": {
"name": "Commvault Web Server 11.32.89",
"product_id": "CSAFPID-0004"
}
},
{
"category": "product_version_range",
"name": "\u003e=11.28.0|\u003c11.28.141",
"product": {
"name": "Commvault Web Server \u003e=11.28.0|\u003c11.28.141",
"product_id": "CSAFPID-0005"
}
},
{
"category": "product_version",
"name": "11.28.141",
"product": {
"name": "Commvault Web Server 11.28.141",
"product_id": "CSAFPID-0006"
}
},
{
"category": "product_version_range",
"name": "\u003e=11.20.0|\u003c11.20.217",
"product": {
"name": "Commvault Web Server \u003e=11.20.0|\u003c11.20.217",
"product_id": "CSAFPID-0007"
}
},
{
"category": "product_version",
"name": "11.20.217",
"product": {
"name": "Commvault Web Server 11.20.217",
"product_id": "CSAFPID-0008"
}
}
],
"category": "product_name",
"name": "Web Server"
}
],
"category": "vendor",
"name": "Commvault"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-3928",
"notes": [
{
"category": "summary",
"text": "Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: \"Webservers can be compromised through bad actors creating and executing webshells.\" Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.",
"title": "Description"
},
{
"category": "details",
"text": "SSVCv2/E:N/A:N/T:T/2025-04-25T17:58:52Z/",
"title": "SSVC"
}
],
"product_status": {
"fixed": [
"CSAFPID-0002",
"CSAFPID-0004",
"CSAFPID-0006",
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0005",
"CSAFPID-0007"
]
},
"references": [
{
"category": "external",
"summary": "documentation.commvault.com",
"url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"
},
{
"category": "external",
"summary": "www.cisa.gov",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928"
},
{
"category": "external",
"summary": "www.commvault.com",
"url": "https://www.commvault.com/blogs/security-advisory-march-7-2025"
},
{
"category": "external",
"summary": "www.commvault.com",
"url": "https://www.commvault.com/blogs/notice-security-advisory-update"
}
],
"release_date": "2025-02-24T00:00:00Z",
"remediations": [
{
"category": "mitigation",
"date": "2025-02-24T05:00:00Z",
"details": "Fixed in 11.36.46.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"
},
{
"category": "vendor_fix",
"date": "2025-02-24T05:00:00Z",
"details": "Fixed in 11.36.46.",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"
},
{
"category": "vendor_fix",
"date": "2025-02-24T05:00:00Z",
"details": "Fixed in 11.32.89.",
"product_ids": [
"CSAFPID-0003"
],
"url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"
},
{
"category": "vendor_fix",
"date": "2025-02-24T05:00:00Z",
"details": "Fixed in 11.32.89.",
"product_ids": [
"CSAFPID-0004"
],
"url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"
},
{
"category": "vendor_fix",
"date": "2025-02-24T05:00:00Z",
"details": "Fixed in 11.28.141.",
"product_ids": [
"CSAFPID-0005"
],
"url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"
},
{
"category": "vendor_fix",
"date": "2025-02-24T05:00:00Z",
"details": "Fixed in 11.28.141.",
"product_ids": [
"CSAFPID-0006"
],
"url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"
},
{
"category": "vendor_fix",
"date": "2025-02-24T05:00:00Z",
"details": "Fixed in 11.20.217.",
"product_ids": [
"CSAFPID-0007"
],
"url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"
},
{
"category": "vendor_fix",
"date": "2025-02-24T05:00:00Z",
"details": "Fixed in 11.20.217.",
"product_ids": [
"CSAFPID-0008"
],
"url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0005",
"CSAFPID-0007"
]
}
],
"title": "Commvault Web Server unspecified vulnerability"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…