8.8
CVSS 3.1
Няма данни
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Да
Атакува се
в каталога KEV от 28 април 2025
Атакува се в момента
3 дни
Време до експлоатация
след публикуването
Атакува се по мрежата, без особени условия, с обикновен потребителски вход и без действие от потребителя.
- Експлоатация: активно се експлоатира
- Атаката не може да се автоматизира
Описание
Оригинално описание
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.
Засегнати продукти
- Commvault Web Server: 11.36.0 преди 11.36.46; 11.36.46; 11.32.0 преди 11.32.89; 11.32.89; 11.28.0 преди 11.28.141; 11.28.141; 11.20.0 преди 11.20.217; 11.20.217
Вид слабост
История
- 25 април 2025 Публикувано
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2025-3928
- https://nvd.nist.gov/vuln/detail/CVE-2025-3928
- https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928
- https://www.commvault.com/blogs/security-advisory-march-7-2025
- https://www.commvault.com/blogs/notice-security-advisory-update
- https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic
- https://www.commvault.com/blogs/customer-security-update
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3928
- https://www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/