Path Traversal Vulnerability in Commvault Command Center Exposes Systems to Risk

What changed

A recently identified vulnerability in the Commvault Command Center allows unauthenticated users to exploit path traversal weaknesses. This flaw enables the upload of malicious ZIP files that, when unpacked, can lead to remote code execution through compromised JSP files.

The vulnerability affects versions 11.38.0 to 11.38.20 of the Command Center Innovation Release. Remediation has been implemented in updates 11.38.20 and 11.38.25.

Who is affected

Organizations utilizing Commvault Command Center are at risk due to this vulnerability. The following groups are particularly impacted:

Users of Commvault Command Center versions 11.38.0 to 11.38.20 should take immediate action to mitigate risks.

• Commvault Command Center Innovation Release versions 11.38.0 to 11.38.20
• Organizations relying on Commvault for data management and protection
• IT departments managing Commvault installations
• Any entity that has not updated to the latest software versions

What to do

To safeguard against potential exploitation, it is crucial for affected users to update their systems promptly. The latest versions include critical patches that address this vulnerability.

Monitoring for unusual activities and ensuring robust security practices can help mitigate risks associated with this vulnerability.

• Upgrade to Commvault Command Center version 11.38.20 or 11.38.25.
• Implement security measures to detect unauthorized file uploads.
• Regularly review and update security protocols in line with best practices.