CVE-2021-34994

· HIGHModified

← All CVEs

CVSS v3.1

8.8

EPSS

5.79%

Published

Jan 13, 2022

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the DataProvider class. The issue results from the lack of proper validation of a user-supplied string before executing it as JavaScript code. An attacker can leverage this vulnerability to escape the JavaScript sandbox and execute Java code in the context of NETWORK SERVICE. Was ZDI-CAN-13755.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-20CWE-94

Affected Products (1)

commvault · commcellvulnerable

References (2)

https://www.zerodayinitiative.com/advisories/ZDI-21-1329/

Third Party AdvisoryVDB Entry

https://www.zerodayinitiative.com/advisories/ZDI-21-1329/

Third Party AdvisoryVDB Entry

KEV Catalog EPSS Scores Vendors All CVEs