PT-2015-2615 · Commvault · Commvault Edge Server

Markus Wulftange + 1 · Publicado 2015-11-04 · Atualizado 2015-11-04 · CVE-2015-7253

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Commvault Edge Server version 10 R2

Description The issue allows remote attackers to execute arbitrary OS commands via crafted serialized data in a cookie. This is due to the lack of measures to neutralize special elements used in the operating system command. Exploitation of the issue may allow a remote attacker to execute arbitrary commands using a specially crafted sequence of data in a cookie.

Recommendations For Commvault Edge Server version 10 R2, consider disabling access to the Web Console until a patch is available to prevent exploitation. Restrict access to the cookie that allows the execution of arbitrary OS commands to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2015-11980

CVE-2015-7253

Produtos afetados

Commvault Edge Server

Referências · 3

• http://kb.cert.org/vuls/id/866432 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7253 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-11980 · Nota de Segurança