CVE-2024-13976 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During the installation of maintenance updates, an attacker with local access may exploit uncontrolled search path or DLL loading behavior to execute arbitrary code with elevated privileges. The vulnerability has been resolved in versions 11.20.202, 11.28.124, 11.32.65, 11.34.37, and 11.36.15.

Reserved 2025-07-23 | Published 2025-07-25 | Updated 2025-07-25 | Assigner VulnCheck

HIGH: 8.5CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-427 Uncontrolled Search Path Element

Product status

Default status

unaffected

11.20.0 before 11.20.202

affected

11.28.0 before 11.28.124

affected

11.32.0 before 11.32.65

affected

11.34.0 before 11.34.37

affected

11.36.0 before 11.36.15

affected

Credits

Commvault finder

References

documentation.commvault.com/...yadvisories/CV_2024_09_2.html vendor-advisory patch

www.vulncheck.com/...ows-maintenance-installer-dll-injection third-party-advisory

cve.org (CVE-2024-13976)

nvd.nist.gov (CVE-2024-13976)

Download JSON

https://cve.threatint.eu/CVE/CVE-2024-13976

Support options

Helpdesk Chat, Email, Knowledgebase