CVE-2025-34136
BaseFortify
Publication date: 2025-07-25
Last updated on: 2025-07-29
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| commvault | web_server | 11.38.0 |
| commvault | web_server | 11.36.0 |
| commvault | web_server | 11.38.19 |
| commvault | web_server | 11.32.0 |
| commvault | web_server | 11.32.93 |
| commvault | web_server | 11.36.51 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-34136 is a medium-severity SQL Injection vulnerability in Commvault CommServe Web Server versions 11.32.0 through 11.32.93, 11.36.0 through 11.36.51, and 11.38.0 through 11.38.19. It allows a remote, unauthenticated attacker to perform SQL Injection attacks on the Web Server component, potentially compromising the database. This vulnerability affects systems where the CommServe and Web Server roles are installed, but not other Commvault components in the same environment. [1, 2]
How can this vulnerability impact me? :
This vulnerability can allow a remote attacker without authentication to perform SQL Injection attacks on the Commvault Web Server, potentially compromising the underlying database. This could lead to unauthorized access to sensitive data, data manipulation, or disruption of services related to the CommServe and Web Server roles. Client computers and other Commvault components are not affected. To mitigate the risk, affected users should immediately install the resolved maintenance releases or isolate the Web Server and Command Center from external network access if updates are not possible. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
To mitigate CVE-2025-34136, immediately install the resolved maintenance releases on CommServe, Web Servers, and Command Center installations. The fixed versions are 11.32.94, 11.36.52, and 11.38.20 (and later). If updating is not possible, isolate the Command Center and Web Server from external network access. Innovation releases are managed automatically and require no manual intervention. Refer to Commvault’s software update documentation for further installation guidance. [2]