{ "document": { "category": "csaf_vex", "csaf_version": "2.0", "lang": "en-US", "publisher": { "category": "coordinator", "contact_details": "https://www.cisa.gov/report", "issuing_authority": "CISA", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "title": "Commvault Web Server unspecified vulnerability", "tracking": { "current_release_date": "2025-04-30T00:00:00Z", "generator": { "engine": { "name": "VINCE-NT", "version": "1.8.0" } }, "id": "VA-25-120-01", "initial_release_date": "2025-04-30T00:00:00Z", "status": "final", "version": "1.0.0", "revision_history": [ { "number": "1.0.0", "summary": "Initial publication", "date": "2025-04-30T00:00:00Z" } ] }, "distribution": { "tlp": { "label": "WHITE" } }, "notes": [ { "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).", "title": "Legal Notice", "category": "legal_disclaimer" }, { "text": "Worldwide", "title": "Countries and Areas Deployed", "category": "other" }, { "text": "Information Technology", "title": "Critical Infrastructure Sectors", "category": "other" }, { "text": "According to Commvault: \"The Web Server is a component in CommCell environments that provides a RESTful interface to the software where users can perform various tasks using available APIs\". A remote, authenticated attacker can exploit an unspecified vulnerability to compromise a Commvault Web Server.", "title": "Risk Evaluation", "category": "summary" }, { "text": "Upgrade to one of the fixed versions (11.36.46, 11.32.89, 11.28.141, or 11.20.217) for Windows and Linux platforms.", "title": "Recommended Practices", "category": "general" }, { "text": "United States", "title": "Company Headquarters Location", "category": "other" } ], "references": [ { "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-120-01.json", "summary": "Vulnerability Advisory VA-25-120-01 CSAF", "category": "self" } ] }, "product_tree": { "branches": [ { "category": "vendor", "name": "Commvault", "branches": [ { "category": "product_name", "name": "Web Server", "branches": [ { "category": "product_version_range", "name": ">=11.36.0|<11.36.46", "product": { "name": "Commvault Web Server >=11.36.0|<11.36.46", "product_id": "CSAFPID-0001" } }, { "category": "product_version", "name": "11.36.46", "product": { "name": "Commvault Web Server 11.36.46", "product_id": "CSAFPID-0002" } }, { "category": "product_version_range", "name": ">=11.32.0|<11.32.89", "product": { "name": "Commvault Web Server >=11.32.0|<11.32.89", "product_id": "CSAFPID-0003" } }, { "category": "product_version", "name": "11.32.89", "product": { "name": "Commvault Web Server 11.32.89", "product_id": "CSAFPID-0004" } }, { "category": "product_version_range", "name": ">=11.28.0|<11.28.141", "product": { "name": "Commvault Web Server >=11.28.0|<11.28.141", "product_id": "CSAFPID-0005" } }, { "category": "product_version", "name": "11.28.141", "product": { "name": "Commvault Web Server 11.28.141", "product_id": "CSAFPID-0006" } }, { "category": "product_version_range", "name": ">=11.20.0|<11.20.217", "product": { "name": "Commvault Web Server >=11.20.0|<11.20.217", "product_id": "CSAFPID-0007" } }, { "category": "product_version", "name": "11.20.217", "product": { "name": "Commvault Web Server 11.20.217", "product_id": "CSAFPID-0008" } } ] } ] } ] }, "vulnerabilities": [ { "cve": "CVE-2025-3928", "notes": [ { "category": "summary", "text": "Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: \"Webservers can be compromised through bad actors creating and executing webshells.\" Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.", "title": "Description" }, { "category": "details", "title": "SSVC", "text": "SSVCv2/E:N/A:N/T:T/2025-04-25T17:58:52Z/" } ], "title": "Commvault Web Server unspecified vulnerability", "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0003", "CSAFPID-0005", "CSAFPID-0007" ], "fixed": [ "CSAFPID-0002", "CSAFPID-0004", "CSAFPID-0006", "CSAFPID-0008" ] }, "references": [ { "category": "external", "summary": "documentation.commvault.com", "url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html" }, { "category": "external", "summary": "www.cisa.gov", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928" }, { "category": "external", "summary": "www.commvault.com", "url": "https://www.commvault.com/blogs/security-advisory-march-7-2025" }, { "category": "external", "summary": "www.commvault.com", "url": "https://www.commvault.com/blogs/notice-security-advisory-update" } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0003", "CSAFPID-0005", "CSAFPID-0007" ] } ], "remediations": [ { "category": "mitigation", "details": "Fixed in 11.36.46.", "url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html", "product_ids": [ "CSAFPID-0001" ], "date": "2025-02-24T05:00:00Z" }, { "category": "vendor_fix", "details": "Fixed in 11.36.46.", "url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html", "product_ids": [ "CSAFPID-0002" ], "date": "2025-02-24T05:00:00Z" }, { "category": "vendor_fix", "details": "Fixed in 11.32.89.", "url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html", "product_ids": [ "CSAFPID-0003" ], "date": "2025-02-24T05:00:00Z" }, { "category": "vendor_fix", "details": "Fixed in 11.32.89.", "url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html", "product_ids": [ "CSAFPID-0004" ], "date": "2025-02-24T05:00:00Z" }, { "category": "vendor_fix", "details": "Fixed in 11.28.141.", "url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html", "product_ids": [ "CSAFPID-0005" ], "date": "2025-02-24T05:00:00Z" }, { "category": "vendor_fix", "details": "Fixed in 11.28.141.", "url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html", "product_ids": [ "CSAFPID-0006" ], "date": "2025-02-24T05:00:00Z" }, { "category": "vendor_fix", "details": "Fixed in 11.20.217.", "url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html", "product_ids": [ "CSAFPID-0007" ], "date": "2025-02-24T05:00:00Z" }, { "category": "vendor_fix", "details": "Fixed in 11.20.217.", "url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html", "product_ids": [ "CSAFPID-0008" ], "date": "2025-02-24T05:00:00Z" } ], "release_date": "2025-02-24T00:00:00Z" } ] }