VDB

CVE-2025-34028

CVE-2025-34028 PUBLISHED KEV CVSS 9.300000190734863 CRITICAL

A path traversal vulnerability in Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files, which, when expanded by the target server, result in Remote Code Execution. This issue affects Command Center Innovation Release: 11.38.

EPSS 97.60% · 99.9th percentile

Risk Scores

CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score
97.60%
99.9th percentile

Affected Products

VendorProductVersions
commvaultcommvault11.38.0, 11.38.0
CommvaultCommand Center Innovation Release11.38.0

Timeline

  • May 30, 2024 CrowdSec Sighting
  • May 31, 2024 CrowdSec Sighting
  • Jun 17, 2024 CrowdSec Sighting
  • Jun 29, 2024 CrowdSec Sighting
  • Jul 9, 2024 CrowdSec Sighting
  • Jul 13, 2024 CrowdSec Sighting
  • Jul 13, 2024 CrowdSec Sighting
  • Aug 15, 2024 CrowdSec Sighting
  • Sep 3, 2024 CrowdSec Sighting
  • Oct 8, 2024 CrowdSec Sighting
  • Nov 2, 2024 CrowdSec Sighting
  • Nov 28, 2024 CrowdSec Sighting

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›