This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AppStudioUploadHandler class. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-13894.
Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas de Commvault CommCell versión 11.22.22. Aunque la autenticación es necesaria para explotar esta vulnerabilidad, el mecanismo de autenticación existente puede ser omitido. El fallo específico se presenta en la clase AppStudioUploadHandler. El problema es debido a que no son comprobados apropiadamente los datos suministrados por el usuario, lo que puede permitir la carga de archivos arbitrarios. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto de NETWORK SERVICE. Fue ZDI-CAN-13894
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
The specific flaw exists within the AppStudioUploadHandler class. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE.
