va-25-120-01
Vulnerability from csaf_cisa
Published
2025-04-30 00:00
Modified
2025-04-30 00:00
Summary
Commvault Web Server unspecified vulnerability
Notes
Legal Notice
All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).
Countries and Areas Deployed
Worldwide
Critical Infrastructure Sectors
Information Technology
Risk Evaluation
According to Commvault: "The Web Server is a component in CommCell environments that provides a RESTful interface to the software where users can perform various tasks using available APIs". A remote, authenticated attacker can exploit an unspecified vulnerability to compromise a Commvault Web Server.
Recommended Practices
Upgrade to one of the fixed versions (11.36.46, 11.32.89, 11.28.141, or 11.20.217) for Windows and Linux platforms.
Company Headquarters Location
United States
{
"document": {
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "en-US",
"notes": [
{
"category": "legal_disclaimer",
"text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
"title": "Legal Notice"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries and Areas Deployed"
},
{
"category": "other",
"text": "Information Technology",
"title": "Critical Infrastructure Sectors"
},
{
"category": "summary",
"text": "According to Commvault: \"The Web Server is a component in CommCell environments that provides a RESTful interface to the software where users can perform various tasks using available APIs\". A remote, authenticated attacker can exploit an unspecified vulnerability to compromise a Commvault Web Server.",
"title": "Risk Evaluation"
},
{
"category": "general",
"text": "Upgrade to one of the fixed versions (11.36.46, 11.32.89, 11.28.141, or 11.20.217) for Windows and Linux platforms.",
"title": "Recommended Practices"
},
{
"category": "other",
"text": "United States",
"title": "Company Headquarters Location"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "https://www.cisa.gov/report",
"issuing_authority": "CISA",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "Vulnerability Advisory VA-25-120-01 CSAF",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-120-01.json"
}
],
"title": "Commvault Web Server unspecified vulnerability",
"tracking": {
"current_release_date": "2025-04-30T00:00:00Z",
"generator": {
"engine": {
"name": "VINCE-NT",
"version": "1.8.0"
}
},
"id": "VA-25-120-01",
"initial_release_date": "2025-04-30T00:00:00Z",
"revision_history": [
{
"date": "2025-04-30T00:00:00Z",
"number": "1.0.0",
"summary": "Initial publication"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e=11.36.0|\u003c11.36.46",
"product": {
"name": "Commvault Web Server \u003e=11.36.0|\u003c11.36.46",
"product_id": "CSAFPID-0001"
}
},
{
"category": "product_version",
"name": "11.36.46",
"product": {
"name": "Commvault Web Server 11.36.46",
"product_id": "CSAFPID-0002"
}
},
{
"category": "product_version_range",
"name": "\u003e=11.32.0|\u003c11.32.89",
"product": {
"name": "Commvault Web Server \u003e=11.32.0|\u003c11.32.89",
"product_id": "CSAFPID-0003"
}
},
{
"category": "product_version",
"name": "11.32.89",
"product": {
"name": "Commvault Web Server 11.32.89",
"product_id": "CSAFPID-0004"
}
},
{
"category": "product_version_range",
"name": "\u003e=11.28.0|\u003c11.28.141",
"product": {
"name": "Commvault Web Server \u003e=11.28.0|\u003c11.28.141",
"product_id": "CSAFPID-0005"
}
},
{
"category": "product_version",
"name": "11.28.141",
"product": {
"name": "Commvault Web Server 11.28.141",
"product_id": "CSAFPID-0006"
}
},
{
"category": "product_version_range",
"name": "\u003e=11.20.0|\u003c11.20.217",
"product": {
"name": "Commvault Web Server \u003e=11.20.0|\u003c11.20.217",
"product_id": "CSAFPID-0007"
}
},
{
"category": "product_version",
"name": "11.20.217",
"product": {
"name": "Commvault Web Server 11.20.217",
"product_id": "CSAFPID-0008"
}
}
],
"category": "product_name",
"name": "Web Server"
}
],
"category": "vendor",
"name": "Commvault"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-3928",
"notes": [
{
"category": "summary",
"text": "Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: \"Webservers can be compromised through bad actors creating and executing webshells.\" Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.",
"title": "Description"
},
{
"category": "details",
"text": "SSVCv2/E:N/A:N/T:T/2025-04-25T17:58:52Z/",
"title": "SSVC"
}
],
"product_status": {
"fixed": [
"CSAFPID-0002",
"CSAFPID-0004",
"CSAFPID-0006",
"CSAFPID-0008"
],
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0005",
"CSAFPID-0007"
]
},
"references": [
{
"category": "external",
"summary": "documentation.commvault.com",
"url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"
},
{
"category": "external",
"summary": "www.cisa.gov",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928"
},
{
"category": "external",
"summary": "www.commvault.com",
"url": "https://www.commvault.com/blogs/security-advisory-march-7-2025"
},
{
"category": "external",
"summary": "www.commvault.com",
"url": "https://www.commvault.com/blogs/notice-security-advisory-update"
}
],
"release_date": "2025-02-24T00:00:00Z",
"remediations": [
{
"category": "mitigation",
"date": "2025-02-24T05:00:00Z",
"details": "Fixed in 11.36.46.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"
},
{
"category": "vendor_fix",
"date": "2025-02-24T05:00:00Z",
"details": "Fixed in 11.36.46.",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"
},
{
"category": "vendor_fix",
"date": "2025-02-24T05:00:00Z",
"details": "Fixed in 11.32.89.",
"product_ids": [
"CSAFPID-0003"
],
"url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"
},
{
"category": "vendor_fix",
"date": "2025-02-24T05:00:00Z",
"details": "Fixed in 11.32.89.",
"product_ids": [
"CSAFPID-0004"
],
"url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"
},
{
"category": "vendor_fix",
"date": "2025-02-24T05:00:00Z",
"details": "Fixed in 11.28.141.",
"product_ids": [
"CSAFPID-0005"
],
"url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"
},
{
"category": "vendor_fix",
"date": "2025-02-24T05:00:00Z",
"details": "Fixed in 11.28.141.",
"product_ids": [
"CSAFPID-0006"
],
"url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"
},
{
"category": "vendor_fix",
"date": "2025-02-24T05:00:00Z",
"details": "Fixed in 11.20.217.",
"product_ids": [
"CSAFPID-0007"
],
"url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"
},
{
"category": "vendor_fix",
"date": "2025-02-24T05:00:00Z",
"details": "Fixed in 11.20.217.",
"product_ids": [
"CSAFPID-0008"
],
"url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0003",
"CSAFPID-0005",
"CSAFPID-0007"
]
}
],
"title": "Commvault Web Server unspecified vulnerability"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…