Skip to content
CVE PROGRAM SOURCE RECORD8.5 High

CVE-2024-13976

Commvault 11.20.0 - 11.36.0 Windows Maintenance Installer DLL Injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During the installation of maintenance updates, an attacker with local access may exploit uncontrolled search path or DLL loading behavior to execute arbitrary code with elevated privileges. The vulnerability has been resolved in versions 11.20.202, 11.28.124, 11.32.65, 11.34.37, and 11.36.15.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Commvault Commvault for Windows

Default version status: unaffected

  • 11.20.0 to < 11.20.202affected
  • 11.28.0 to < 11.28.124affected
  • 11.32.0 to < 11.32.65affected
  • 11.34.0 to < 11.34.37affected
  • 11.36.0 to < 11.36.15affected

References