高危
Commvault Web Server安全漏洞
2025-04-25 15:56:28 公开 ，2026-03-02 06:43:13 更新
- CISA KEV
- 关键漏洞
- 远程
- 公开PoC
- SSVC：
- 可利用状态：已被积极利用攻击自动化：否技术影响评估：全部 2025-04-30 11:56:24
风险信息
- CVSS v3.1 向量
- AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v3.1 风险值
- 8.8
- CVSS v4.0 向量
- AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CVSS v4.0 风险值
- 8.7
详细信息
- 漏洞类型
- 其他
- 漏洞描述
- Commvault Web Server存在不明漏洞，经过身份验证的远程攻击者可利用该漏洞。Web服务器可能会通过创建和执行Webshell的不良行为者而受到损害。
- 修复建议
- 请升级到Windows和Linux平台的11.36.46、11.32.89、11.28.141和11.20.217或更高版本，参考链接： https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html
参考链接
- https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html
CVE · Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-3928
CNNVD
- https://www.commvault.com/blogs/notice-security-advisory-update
CVE · Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928
CVE · Third Party Advisory · US Government Resource
- https://www.commvault.com/blogs/security-advisory-march-7-2025
CVE · Vendor Advisory
- https://www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/
NVD · Third Party Advisory
- https://www.commvault.com/blogs/customer-security-update
CVE · Vendor Advisory
- https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic
CVE · Third Party Advisory · US Government Resource
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3928
NVD · US Government Resource