CVE-2025-3928 (GCVE-0-2025-3928)

Vulnerability from cvelistv5 – Published: 2025-04-25 15:56 – Updated: 2025-10-21 22:55
VLAI?
Title
Commvault Web Server unspecified vulnerability
Summary
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE
Assigner
References
Impacted products
Vendor Product Version
Commvault Web Server Affected: 11.36.0 , < 11.36.46 (custom)
Unaffected: 11.36.46
Affected: 11.32.0 , < 11.32.89 (custom)
Unaffected: 11.32.89
Affected: 11.28.0 , < 11.28.141 (custom)
Unaffected: 11.28.141
Affected: 11.20.0 , < 11.20.217 (custom)
Unaffected: 11.20.217
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3928",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-30T03:56:24.936967Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-04-28",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3928"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T22:55:17.806Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3928"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-04-28T00:00:00+00:00",
            "value": "CVE-2025-3928 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-05-05T13:34:41.408Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Web Server",
          "vendor": "Commvault",
          "versions": [
            {
              "lessThan": "11.36.46",
              "status": "affected",
              "version": "11.36.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "11.36.46"
            },
            {
              "lessThan": "11.32.89",
              "status": "affected",
              "version": "11.32.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "11.32.89"
            },
            {
              "lessThan": "11.28.141",
              "status": "affected",
              "version": "11.28.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "11.28.141"
            },
            {
              "lessThan": "11.20.217",
              "status": "affected",
              "version": "11.20.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "11.20.217"
            }
          ]
        }
      ],
      "datePublic": "2025-02-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: \"Webservers can be compromised through bad actors creating and executing webshells.\" Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2025-3928",
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "no"
                },
                {
                  "Technical Impact": "total"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2025-04-25T17:58:52.842478Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-noinfo Not enough information",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-27T20:03:27.556Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"
        },
        {
          "name": "url",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928"
        },
        {
          "name": "url",
          "url": "https://www.commvault.com/blogs/security-advisory-march-7-2025"
        },
        {
          "name": "url",
          "url": "https://www.commvault.com/blogs/notice-security-advisory-update"
        },
        {
          "name": "url",
          "url": "https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic"
        },
        {
          "name": "url",
          "url": "https://www.commvault.com/blogs/customer-security-update"
        }
      ],
      "title": "Commvault Web Server unspecified vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2025-3928",
    "datePublished": "2025-04-25T15:56:28.112Z",
    "dateReserved": "2025-04-24T19:55:32.578Z",
    "dateUpdated": "2025-10-21T22:55:17.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2025-3928",
      "dateAdded": "2025-04-28",
      "dueDate": "2025-05-19",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html;   https://www.commvault.com/blogs/notice-security-advisory-update;   https://nvd.nist.gov/vuln/detail/CVE-2025-3928      ",
      "product": "Web Server",
      "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.",
      "vendorProject": "Commvault",
      "vulnerabilityName": "Commvault Web Server Unspecified Vulnerability"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/\"}], \"x_generator\": {\"engine\": \"ADPogram 0.0.1\"}, \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-05-05T13:34:41.408Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-3928\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-30T03:56:24.936967Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2025-04-28\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3928\"}}}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-04-28T00:00:00+00:00\", \"value\": \"CVE-2025-3928 added to CISA KEV\"}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3928\", \"tags\": [\"government-resource\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-25T16:09:31.829Z\"}}], \"cna\": {\"title\": \"Commvault Web Server unspecified vulnerability\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-3928\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-25T17:58:52.842478Z\"}}}], \"affected\": [{\"vendor\": \"Commvault\", \"product\": \"Web Server\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.36.0\", \"lessThan\": \"11.36.46\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"11.36.46\"}, {\"status\": \"affected\", \"version\": \"11.32.0\", \"lessThan\": \"11.32.89\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"11.32.89\"}, {\"status\": \"affected\", \"version\": \"11.28.0\", \"lessThan\": \"11.28.141\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"11.28.141\"}, {\"status\": \"affected\", \"version\": \"11.20.0\", \"lessThan\": \"11.20.217\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"11.20.217\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2025-02-24T00:00:00.000Z\", \"references\": [{\"url\": \"https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html\", \"name\": \"url\"}, {\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928\", \"name\": \"url\"}, {\"url\": \"https://www.commvault.com/blogs/security-advisory-march-7-2025\", \"name\": \"url\"}, {\"url\": \"https://www.commvault.com/blogs/notice-security-advisory-update\", \"name\": \"url\"}, {\"url\": \"https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic\", \"name\": \"url\"}, {\"url\": \"https://www.commvault.com/blogs/customer-security-update\", \"name\": \"url\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: \\\"Webservers can be compromised through bad actors creating and executing webshells.\\\" Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"9119a7d8-5eab-497f-8521-727c672e3725\", \"shortName\": \"cisa-cg\", \"dateUpdated\": \"2025-05-27T20:03:27.556Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-3928\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-21T22:55:17.806Z\", \"dateReserved\": \"2025-04-24T19:55:32.578Z\", \"assignerOrgId\": \"9119a7d8-5eab-497f-8521-727c672e3725\", \"datePublished\": \"2025-04-25T15:56:28.112Z\", \"assignerShortName\": \"cisa-cg\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.