CVE-2025-57788
BaseFortify
Publication date: 2025-08-20
Last updated on: 2025-09-10
Assigner: Commvault
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| commvault | commvault | to 11.36.60 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-259 | The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Commvault before version 11.36.60 allows unauthenticated attackers to execute API calls without needing user credentials due to a flaw in the login mechanism. Although Role-Based Access Control (RBAC) helps limit the exposure, it does not completely eliminate the risk. The issue affects certain Linux and Windows versions of Commvault and is resolved in maintenance releases 11.32.102 and 11.36.60. [1]
How can this vulnerability impact me? :
The vulnerability allows unauthenticated attackers to perform API calls without credentials, potentially leading to unauthorized access or actions within the Commvault system. While RBAC limits what attackers can do, the risk of unauthorized operations remains, which could compromise system integrity or data security. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect the vulnerability by verifying the Commvault Web Server component version. Use the Commvault Command Center: navigate to Manage > Servers, filter by the Web Server role, and confirm that all servers are running the resolved maintenance release (11.32.102 or later for 11.32.x versions, 11.36.60 or later for 11.36.x versions). There are no specific command-line commands provided, but this GUI method is recommended for verification. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediately update the Commvault Web Server component to the resolved maintenance release: version 11.32.102 or later for 11.32.x versions, or version 11.36.60 or later for 11.36.x versions. This update fixes the vulnerability allowing unauthenticated API calls. Additionally, ensure Role-Based Access Control (RBAC) is properly configured to limit exposure, although it does not fully eliminate the risk. [1]