PT-2015-2615 · Commvault · Commvault Edge Server

Markus Wulftange + 1 · Published 2015-11-04 · Updated 2015-11-04 · CVE-2015-7253

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Commvault Edge Server version 10 R2

Description The issue allows remote attackers to execute arbitrary OS commands via crafted serialized data in a cookie. This is due to the lack of measures to neutralize special elements used in the operating system command. Exploitation of the issue may allow a remote attacker to execute arbitrary commands using a specially crafted sequence of data in a cookie.

Recommendations For Commvault Edge Server version 10 R2, consider disabling access to the Web Console until a patch is available to prevent exploitation. Restrict access to the cookie that allows the execution of arbitrary OS commands to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2015-11980

CVE-2015-7253

Affected Products

Commvault Edge Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-7253 · Security Note
• https://bdu.fstec.ru/vul/2015-11980 · Security Note
• http://kb.cert.org/vuls/id/866432 · Note