Description
An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, unauthenticated attacker to perform SQL Injection. The vulnerability impacts systems where the CommServe and Web Server roles are installed. Other Commvault components deployed in the same environment are not affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Commvault | Commvault | 11.32.0 – ≤ 11.32.93, 11.36.0 – ≤ 11.36.51, 11.38.0 – ≤ 11.38.19 | — |
Advisories 1
- WID-SEC-2025-1652 Commvault Backup & Recovery: Schwachstelle ermöglicht SQL injection BSI CERT-Bund (WID) · Jul 27, 2025
References
- https://documentation.commvault.com/securityadvisories/CV_2025_04_2.html vendor-advisory patch
- https://www.vulncheck.com/advisories/commvault-commserve-web-server-unauth-sqli third-party-advisory