PT-2020-16204 · Commvault · Commvault

Ron Lifinski · Published 2020-10-29 · Updated 2020-11-13 · CVE-2020-25780

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Commvault versions prior to 14.68 Commvault versions 15.x prior to 15.58 Commvault versions 16.x prior to 16.44 Commvault versions 17.x prior to 17.29 Commvault versions 18.x prior to 18.13

Description The issue allows Directory Traversal, enabling an attacker to view files outside of the intended log-files folder when attempting to access a log file.

Recommendations For versions prior to 14.68, update to version 14.68 or later. For versions 15.x prior to 15.58, update to version 15.58 or later. For versions 16.x prior to 16.44, update to version 16.44 or later. For versions 17.x prior to 17.29, update to version 17.29 or later. For versions 18.x prior to 18.13, update to version 18.13 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-25780

Affected Products

Commvault

References · 3

• https://osv.dev/vulnerability/CVE-2020-25780 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25780 · Security Note
• http://kb.commvault.com/article/63264 · Vendor Advisory