Untitled attachment

Notices where this attachment appears

1. Embed this notice
   Will Dormann (wdormann@infosec.exchange)'s status on Thursday, 08-May-2025 13:25:42 JST Will Dormann

   in reply to

   If we compare pre-patch and post-patch versions of Commvault, we can see that the fix for CVE-2025-34028 is that the endpoints of webpackage.do, deployWebpackage.do, and deployServiceCommcell.do are no longer exempt from authentication. And while they were at it, they removed the web endpoints altogether.

   So yeah, while the CVE entry for CVE-2025-34028 indicates that the vulnerability is a directory traversal, the real vulnerability is (IMO) that an unauthenticated user can install packages on a Commvault server.

   Sure, the directory traversal makes the impact bad. But the underlying problem is that the endpoint can be reached by unauthenticated users. And that's what was corrected with the updates.