PT-2025-30892 · Commvault · Commvault

Published 2025-07-25 · Updated 2025-07-25 · CVE-2025-34136

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Commvault versions 11.32.0 through 11.32.93 Commvault versions 11.36.0 through 11.36.51 Commvault versions 11.38.0 through 11.38.19

Description An SQL injection vulnerability exists in the Web Server component that could allow a remote, unauthenticated attacker to perform SQL Injection. The vulnerability impacts systems where the CommServe and Web Server roles are installed. Other Commvault components deployed in the same environment are not affected.

Recommendations Commvault versions 11.32.0 through 11.32.93: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Commvault versions 11.36.0 through 11.36.51: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Commvault versions 11.38.0 through 11.38.19: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-34136

Affected Products

Commvault

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-34136 · Security Note
• https://vulncheck.com/advisories/commvault-commserve-web-server-unauth-sqli · Note
• https://documentation.commvault.com/securityadvisories/CV_2025_04_2.html · Patch, Vendor Advisory
• https://twitter.com/CVEnew/status/1948782088905523485 · Twitter Post