Critical Path Traversal Vulnerability in Commvault Command Center

What changed

A significant vulnerability has been identified in the Commvault Command Center, specifically within versions 11.38.0 to 11.38.20. This path traversal vulnerability permits unauthenticated actors to upload malicious ZIP files, which could lead to remote code execution when processed by the server.

The issue has been addressed in version 11.38.20 and later, with specific fixes included in service packs SP38-CU20-433, SP38-CU20-436, SP38-CU25-434, and SP38-CU25-438.

Who is affected

Organizations utilizing the Commvault Command Center Innovation Release are at risk, particularly those operating on the affected versions.

The vulnerability primarily impacts users who have not yet upgraded to the patched versions.

• Commvault Command Center versions 11.38.0 to 11.38.20
• Organizations relying on Commvault for data management and backup solutions
• IT departments managing Commvault installations without the latest updates

What to do

Immediate action is required to mitigate the risks associated with this vulnerability. Organizations should prioritize upgrading to the latest patched versions of Commvault Command Center.

Review security policies and ensure that all systems are monitored for unauthorized file uploads or other suspicious activities.

• Upgrade to Commvault Command Center version 11.38.20 or later
• Apply service packs SP38-CU20-433, SP38-CU20-436, SP38-CU25-434, and SP38-CU25-438
• Conduct a security assessment to identify any potential exploitation of this vulnerability