CVE-2025-34028

Published Apr 22, 2025

Last updated 7 days ago

Commvault

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-34028 is a vulnerability in Commvault Command Center Innovation Release that allows an unauthenticated attacker to upload ZIP files. This path traversal vulnerability can lead to remote code execution when the server expands these files. The vulnerability affects Command Center Innovation Release versions 11.38.0 through 11.38.19 and has been patched in version 11.38.20. The vulnerability exists in the "deployWebpackage.do" and "deployServiceCommcell.do" endpoints, which are excluded from authentication requirements. An attacker can exploit this by sending an HTTP request to these endpoints, triggering a Server-Side Request Forgery (SSRF) vulnerability. This allows the attacker to force the Commvault server to download a ZIP file from an external server, use path traversal to place files in restricted directories, and ultimately execute malicious code via the web interface.

Description: The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP. This issue affects Command Center Innovation Release: 11.38.
Source: disclosure@vulncheck.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Commvault Command Center Path Traversal Vulnerability
Exploit added on: May 2, 2025
Exploit action due: May 23, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

disclosure@vulncheck.com: CWE-22
nvd@nist.gov: CWE-22

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9C510195-3CF6-460F-8AE0-FDB227262086",
            "versionEndIncluding": "11.38.19",
            "versionStartIncluding": "11.38.0"
          },
          {
            "criteria": "cpe:2.3:a:commvault:commvault:11.38.20:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A858E4E4-A2B2-45B8-A6C1-786703A35EA4"
          },
          {
            "criteria": "cpe:2.3:a:commvault:commvault:11.38.25:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6284A494-F84E-47FB-A415-6D7AAC46BA09"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.